Update cilium to v1.19.6

[vshn-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	1.18.12 → 1.19.6

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

cilium/cilium (cilium)

v1.19.6: 1.19.6

Compare Source

Summary of Changes

Minor Changes:

• datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #​46845, Upstream PR #​46332, @​bersoare)
• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #​46933, Upstream PR #​46403, @​arybolovlev)

Bugfixes:

• [v1.19] Fix policy service label selector handling (#​46946, @​fristonio)
• bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #​46669, Upstream PR #​46325, @​atykhyy)
• doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #​47181, Upstream PR #​47144, @​HadrienPatte)
• endpoint: Fix race when reading endpoint properties (Backport PR #​47181, Upstream PR #​46991, @​gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #​46975, Upstream PR #​46668, @​Suyash1700)
• Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #​46793, Upstream PR #​46747, @​giorio94)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #​46974, Upstream PR #​46927, @​aanm)
• Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #​46826, Upstream PR #​45693, @​eufriction)
• Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #​46669, Upstream PR #​44748, @​shibaPuppy)
• Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #​46691, Upstream PR #​46635, @​mkamadeus)
• Fix ctmap gc duration metric recording (Backport PR #​46975, Upstream PR #​46873, @​fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #​47002, Upstream PR #​46821, @​fristonio)
• Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #​47181, Upstream PR #​46967, @​ysksuzuki)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #​47181, Upstream PR #​46444, @​giorio94)
• Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #​46793, Upstream PR #​46710, @​gentoo-root)
• Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #​46793, Upstream PR #​46643, @​squeed)
• gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #​46837, Upstream PR #​46350, @​xtineskim)
• gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #​46826, Upstream PR #​44889, @​eufriction)
• ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #​47181, Upstream PR #​46867, @​pippolo84)
• operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #​47181, Upstream PR #​47127, @​HadrienPatte)

CI Changes:

• .github: Generate CI binaries with correct module version (Backport PR #​47099, Upstream PR #​46742, @​joestringer)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #​46920, Upstream PR #​46840, @​sekhar-isovalent)
• ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #​46691, Upstream PR #​46632, @​nebril)
• ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #​46888, Upstream PR #​46451, @​nebril)
• Fix workflow change detection for single-commit PRs to main (Backport PR #​46793, Upstream PR #​46684, @​Demiserular)
• Further GC ratchet test fix races (Backport PR #​47224, Upstream PR #​43075, @​tommyp1ckles)

Misc Changes:

• (minor) docs: update reference to aws-cli image (Backport PR #​46975, Upstream PR #​46923, @​squeed)
• .github: allow fork PR checkout with actions/checkout v7 (Backport PR #​47135, Upstream PR #​47133, @​aanm)
• [v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#​46613, @​aanm)
• [v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#​46574, @​aanm)
• [v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#​47083, @​giorio94)
• bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #​46920, Upstream PR #​46383, @​martonra)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #​47181, Upstream PR #​47021, @​pchaigno)
• chore(deps): update all github action dependencies (v1.19) (#​46658, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46908, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​47109, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​46906, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​47045, @​cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#​47124, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​46774, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.12 (v1.19) (#​46982, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#​46726, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#​46773, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#​46657, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#​47039, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#​46700, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#​47122, @​cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (Backport PR #​46691, Upstream PR #​46646, @​sekhar-isovalent)
• chore: optimize building gops and cni/loopback (Backport PR #​46845, Upstream PR #​46781, @​sekhar-isovalent)
• ci: always set fail-fast to false on image builds (Backport PR #​47181, Upstream PR #​47064, @​aanm)
• ci: remove non-ariane workflows from config (Backport PR #​46845, Upstream PR #​46787, @​nebril)
• clustermesh: add reusable backend selector constructor (Backport PR #​46691, Upstream PR #​45648, @​viktor-kurchenko)
• docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #​47181, Upstream PR #​47026, @​maksymbilokur-cisco)
• docs: fix note about ipv4-native-routing-cidr default value (Backport PR #​46793, Upstream PR #​46603, @​rptaylor)
• Egress Gateway: handle nil events (Backport PR #​47181, Upstream PR #​46476, @​tommyp1ckles)
• endpoint: reap restart-preserved policy map entries once ready (Backport PR #​47063, Upstream PR #​47062, @​aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #​47076, Upstream PR #​47075, @​aanm)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #​46793, Upstream PR #​46388, @​tommyp1ckles)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #​46845, Upstream PR #​46388, @​tommyp1ckles)
• fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#​46907, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#​47115, @​cilium-renovate[bot])
• Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #​46826, Upstream PR #​44962, @​eufriction)
• gateway-api: return model from Gateway API ingestion (Backport PR #​46933, Upstream PR #​46450, @​arybolovlev)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #​47181, Upstream PR #​47085, @​aanm)
• Improve cilium-dbg status output of module health (Backport PR #​46845, Upstream PR #​46739, @​joestringer)
• loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #​46826, Upstream PR #​45949, @​eufriction)
• loadbalancer: validate DSR dispatch configuration globally (Backport PR #​46793, Upstream PR #​45545, @​FelipeYepez)
• Makefile: Generate full Cilium version in worktree (Backport PR #​46793, Upstream PR #​46737, @​joestringer)
• Revert restore-path policy map changes (#​46927, #​47062, #​47075) (Backport PR #​47213, Upstream PR #​47202, @​aanm)
• Upgraded cilium/ebpf to version v0.22.0 (Backport PR #​46845, Upstream PR #​46783, @​dylandreimerink)

Other Changes:

• install: Update image digests for v1.19.5 (#​46593, @​cilium-release-bot[bot])
• v1.19: gateway-api: fix sds secrets in golden tests (#​47229, @​0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@​sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@​sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@​sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@​sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@​sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@​sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@​sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@​sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@​sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

v1.19.5: 1.19.5

Compare Source

Summary of Changes

Minor Changes:

• Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #​46554, Upstream PR #​46516, @​giorio94)
• helm: Remove loadBalancer.standalone option (Backport PR #​46170, Upstream PR #​46070, @​joestringer)
• wireguard:mtu: fix mtu calculation with potential padding (Backport PR #​46170, Upstream PR #​45940, @​smagnani96)

Bugfixes:

• Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #​46170, Upstream PR #​46068, @​MrFreezeex)
• azure: Fix public IP reassignment failure loop on operator restart (Backport PR #​46289, Upstream PR #​46240, @​HadrienPatte)
• bgp: Don't provide default_gateway reconciler when disabled (Backport PR #​46024, Upstream PR #​45911, @​YutaroHayakawa)
• bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #​46245, Upstream PR #​45927, @​rastislavs)
• bpf: fix host proxy packet routing to pods (Backport PR #​46024, Upstream PR #​45916, @​atykhyy)
• bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #​46170, Upstream PR #​45937, @​nickolaev)
• datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #​46028, Upstream PR #​45799, @​bersoare)
• Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #​46024, Upstream PR #​45926, @​julianwiedmann)
• Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #​46170, Upstream PR #​45780, @​adamwathieu)
• Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #​46170, Upstream PR #​45967, @​ysksuzuki)
• Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #​46024, Upstream PR #​45572, @​ajmmm)
• Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #​45966, Upstream PR #​45371, @​syedazeez337)
• Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR #​46456, Upstream PR #​46305, @​TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #​46400, Upstream PR #​46340, @​arybolovlev)
• fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #​46400, Upstream PR #​46237, @​ulrichgiraud)
• fix: nil pointer dereference panic due to uninitialized logger (Backport PR #​46170, Upstream PR #​45782, @​weizhoublue)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #​46554, Upstream PR #​46091, @​eyupcanakman)
• Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #​46170, Upstream PR #​46079, @​giorio94)
• Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #​46024, Upstream PR #​45791, @​squeed)
• gateway-api/ingress: set service label on EndpointSlices (Backport PR #​46400, Upstream PR #​46242, @​mhofstetter)
• gateway-api: fix GatewayClass field index (Backport PR #​46289, Upstream PR #​46127, @​thorn3r)
• gateway-api: prune stale Gateway API route parent statuses (Backport PR #​46400, Upstream PR #​46296, @​mhofstetter)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #​46554, Upstream PR #​46412, @​giorio94)
• iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #​46289, Upstream PR #​45974, @​bersoare)
• multipool: Fix retries for CiliumNode Get errors (Backport PR #​46408, Upstream PR #​46124, @​pippolo84)
• sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR #​46024, Upstream PR #​44843, @​umut-polat)
• The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#​46462, @​joamaki)

CI Changes:

• chore(deps): update lvh-images for conformance-runtime (Backport PR #​46025, Upstream PR #​45922, @​julianwiedmann)
• ci:bpftrace: fail curl with corrupted binary download (Backport PR #​46024, Upstream PR #​45948, @​smagnani96)
• fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR #​46289, Upstream PR #​44545, @​liyihuang)
• gha: make conformance kubespray runner configurable (Backport PR #​46289, Upstream PR #​46171, @​giorio94)
• helm: add tmpl files to .helmignore (Backport PR #​46554, Upstream PR #​46445, @​sekhar-isovalent)
• helm: allow overriding of registry_prefix in charts (Backport PR #​46289, Upstream PR #​46217, @​sekhar-isovalent)
• ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR #​46289, Upstream PR #​46188, @​pippolo84)
• Move pull_request triggered workflows to ariane (Backport PR #​46452, Upstream PR #​45363, @​nebril)
• Reapply "ci: Log in for image registry pulls" (Backport PR #​46495, Upstream PR #​46376, @​nebril)

Misc Changes:

• [v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (#​46578, @​aanm)
• [v1.19] Backport health command fixes from 46102 (#​46250, @​joamaki)
• [v1.19] deps: bump various go packages (#​46185, @​ferozsalam)
• [v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (#​46425, @​tklauser)
• bpf: local_delivery: add CB flag for "use_redirect_peer" (Backport PR #​46204, Upstream PR #​46169, @​julianwiedmann)
• bpf: local_delivery: condense usage of skb cb slots (Backport PR #​46204, Upstream PR #​46064, @​julianwiedmann)
• bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (Backport PR #​46554, Upstream PR #​46291, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.19) (#​45994, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46016, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46117, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46268, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46280, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46395, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46538, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​45468, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​46581, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​45995, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​46164, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.11 (v1.19) (#​46342, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.19) (#​46153, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 11ecd4e (v1.19) (#​46277, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to cd47774 (v1.19) (#​46137, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to e1b3ec8 (v1.19) (#​46007, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) (#​46120, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) (#​46267, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) (#​46150, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) (#​46266, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) (#​46570, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.19) (#​46535, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.19) (#​46138, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.19) (#​46536, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (#​46560, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (#​46139, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (#​46561, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (#​46377, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​45392, @​cilium-renovate[bot])
• docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR #​46289, Upstream PR #​45843, @​atykhyy)
• docs: Document BTF as a requirement (Backport PR #​46289, Upstream PR #​46063, @​pchaigno)
• docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR #​46024, Upstream PR #​45751, @​bitflicker64)
• Fix broken gateway-api documentation links (Backport PR #​46554, Upstream PR #​46527, @​0xch4z)
• Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR #​46400, Upstream PR #​46355, @​weizhoublue)
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (#​46140, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) (#​46015, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) (#​46562, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to ff6756f (v1.19) (#​45996, @​cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (#​45997, @​cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (#​46537, @​cilium-renovate[bot])
• Miscellaneous improvements to the fake client (Backport PR #​46024, Upstream PR #​45784, @​giorio94)
• operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR #​46554, Upstream PR #​46502, @​giorio94)
• Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR #​46170, Upstream PR #​46093, @​salamidrus)
• Revert ".github/workflows: do not use deployments for environments" (Backport PR #​46400, Upstream PR #​46348, @​aanm)

Other Changes:

• [v1.19] proxy: Bump upstream version to v1.37.x (#​46439, @​sayboras)
• install: Update image digests for v1.19.4 (#​45961, @​cilium-release-bot[bot])
• v1.19: kvstore: Don't set fake pod CIDRs for remote nodes (#​46361, @​pchaigno)
• vendor: bump statedb to v0.5.8 (#​46505, @​giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.5@​sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.5@​sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b

docker-plugin

quay.io/cilium/docker-plugin:v1.19.5@​sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea

hubble-relay

quay.io/cilium/hubble-relay:v1.19.5@​sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.5@​sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16

operator-aws

quay.io/cilium/operator-aws:v1.19.5@​sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707

operator-azure

quay.io/cilium/operator-azure:v1.19.5@​sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8

operator-generic

quay.io/cilium/operator-generic:v1.19.5@​sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4

operator

quay.io/cilium/operator:v1.19.5@​sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e

v1.19.4: 1.19.4

Compare Source

Summary of Changes

Minor Changes:

• cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR #​45755, Upstream PR #​45504, @​HadrienPatte)
• iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR #​45630, Upstream PR #​45192, @​liyihuang)
• operator/spire: make SPIRE client configurable for ztunnel (Backport PR #​45356, Upstream PR #​44136, @​nddq)
• pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR #​45630, Upstream PR #​45533, @​sjohnsonpal)

Bugfixes:

• bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR #​45695, Upstream PR #​45661, @​julianwiedmann)
• bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR #​45594, Upstream PR #​45588, @​julianwiedmann)
• cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR #​45888, Upstream PR #​44951, @​skymensch)
• cilium: Fix incorrect IPv6 BIG TCP display (Backport PR #​45630, Upstream PR #​45529, @​pchaigno)
• clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR #​45496, Upstream PR #​45402, @​MrFreezeex)
• clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR #​45630, Upstream PR #​45576, @​owayss)
• Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR #​45673, Upstream PR #​44526, @​nebojsaj1726)
• Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR #​45584, Upstream PR #​45522, @​ysksuzuki)
• Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR #​45888, Upstream PR #​45737, @​weizhoublue)
• Fix host L7 policy operation (Backport PR #​45496, Upstream PR #​45030, @​atykhyy)
• Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR #​45630, Upstream PR #​44701, @​hbangT)
• Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR #​45630, Upstream PR #​45557, @​jrife)
• Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR #​45356, Upstream PR #​45179, @​RiccardoAtzori91)
• fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR #​45630, Upstream PR #​44705, @​ieth0)
• fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR #​45630, Upstream PR [#​44662](https:/

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.