Support IPv6 fragments #38110
Merged
Support IPv6 fragments #38110
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bec8adb to
ddaefd2
Compare
|
/test |
2cab3d6 to
44c788f
Compare
|
/test |
dc42d5c to
751334e
Compare
|
/test |
751334e to
c65b247
Compare
|
/test |
c65b247 to
fb2b94b
Compare
|
/test |
e0ccbf8 to
9bf705e
Compare
|
/test |
|
Looks like I'll have to put some of the optimizations planned for future into this PR in order to solve the complexity issues. |
8f3c5c3 to
c86a73a
Compare
This commit doesn't implement support for IPv6 fragments yet, but it prepares all functions to be ready to handle fragments. Everything is supposed to match its IPv4 counterparts. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
fraginfo is available almost everywhere where lb6_extract_tuple is called. Pass it via a parameter to reduce verifier complexity and fit into the limits. Do the parallel change to lb4_extract_tuple. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Currently, ipv6_skip_exthdr drops fragmented packets when it encounters a NEXTHDR_FRAGMENT extension header, because the datapath code wasn't prepared to deal with fragments, and it assumed that IPv6 packets always had an L4 header. Now that the datapath code is adapted to deal with fragments, enable fragment support when parsing extension headers. It affects ipv6_hdrlen and find_dsr_v6. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Store source and destination ports of the first fragment to the IPV6_FRAG_DATAGRAMS_MAP map, and extract them upon receiving further fragments to be able to restore the 5-tuple and match them to the flow. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Fragment ID is stored in big endian in the packet and in the fragment maps. Convert it to native endian to show consistent values regardless of the host architecture. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Reduce the stack space by reusing the IPv6 header for struct frag_id. Also spares a copy of 32 bytes of IPv6 addresses and heavily (2-3x) reduces verifier complexity. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Support for IPv6 fragments increased complexity of BPF programs, and tail_nodeport_nat_ingress_ipv6 started failing on the 1M instruction limit in some configurations on some older kernels in bpf_xdp. Before further optimizations are merged, tailcall into the RevDNAT parts. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
e61cfad to
9143e7d
Compare
|
/test |
aanm
approved these changes
Apr 3, 2025
derailed
approved these changes
Apr 4, 2025
jschwinger233
approved these changes
Apr 11, 2025
|
Could someone from @cilium/sig-agent please approve it? Donia is on PTO. It's big, but the agent changes are tiny. |
|
André already approved on behalf of @cilium/sig-agent. |
github-merge-queue bot
pushed a commit
to chezmoidotsh/arcane
that referenced
this pull request
Jul 29, 2025
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | HelmChart | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@​joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@​ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@​gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@​carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@​l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@​pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@​pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@​caorui-io](https://redirect.github.com/caorui-io), [@​kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@​gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@​rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@​antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@​squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@​kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@​squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@​marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@​squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@​marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@​HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@​giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@​tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@​aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@​orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@​wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@​ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@​christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@​pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@​rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@​Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@​aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@​sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@​squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@​julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@​sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@​sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@​youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@​sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@​41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@​pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@​pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@​pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@​romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@​dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@​yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@​liyihuang](https://redirect.github.com/liyihuang)) #### 🧑💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@​Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@​squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@​brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/chezmoidotsh/arcane). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZTogZGVwZW5kZW5jaWVzIl19-->
renovate bot
added a commit
to lambchop4prez/network
that referenced
this pull request
Jul 29, 2025
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | helm_release | minor | `1.17.6` -> `1.18.0` | | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@​joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@​ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@​gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@​carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@​l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@​pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@​pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@​caorui-io](https://redirect.github.com/caorui-io), [@​kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@​gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@​rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@​antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@​squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@​kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@​squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@​marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@​squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@​marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@​HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@​giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@​tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@​aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@​orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@​wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@​ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@​christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@​pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@​rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@​Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@​aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@​sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@​squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@​julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@​sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@​sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@​youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@​sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@​41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@​pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@​pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@​pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@​romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@​dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@​yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@​liyihuang](https://redirect.github.com/liyihuang)) #### 🧑💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@​Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@​squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@​brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/lambchop4prez/network). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
nicolerenee
pushed a commit
to nicolerenee/infra
that referenced
this pull request
Jul 29, 2025
…ilium ( 1.17.6 → 1.18.0 ) (#709) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/home-operations/charts-mirror/cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (ghcr.io/home-operations/charts-mirror/cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@​joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@​ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@​gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@​carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@​l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@​pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@​pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@​caorui-io](https://redirect.github.com/caorui-io), [@​kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@​gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@​rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@​antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@​squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@​kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@​squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@​marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@​squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@​marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@​HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@​giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@​tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@​aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@​orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@​wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@​ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@​christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@​pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@​rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@​Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@​aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@​sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@​squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@​julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@​sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@​sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@​youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@​sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@​41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@​pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@​pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@​pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@​romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@​dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@​yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@​liyihuang](https://redirect.github.com/liyihuang)) #### 🧑💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@​Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@​squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@​brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40NS4wIiwidXBkYXRlZEluVmVyIjoiNDEuNDUuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==--> Co-authored-by: bot-nicole[bot] <205127124+bot-nicole[bot]@users.noreply.github.com>
renovate bot
added a commit
to rupaschomaker/home-cluster
that referenced
this pull request
Jul 30, 2025
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@​joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@​ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@​gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@​carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@​l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@​pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@​pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@​caorui-io](https://redirect.github.com/caorui-io), [@​kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@​gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@​rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@​antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@​squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@​kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@​squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@​marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@​squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@​marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@​HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@​giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@​tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@​aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@​orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@​wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@​ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@​christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@​pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@​rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@​Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@​aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@​sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@​squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@​julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@​sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@​sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@​youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@​sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@​41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@​pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@​pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@​pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@​romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@​dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@​yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@​liyihuang](https://redirect.github.com/liyihuang)) #### 🧑💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@​Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@​squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@​brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rupaschomaker/home-cluster). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Jul 30, 2025
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](cilium/cilium@1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](cilium/cilium#38469), [@​joamaki](https://github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](cilium/cilium#37723), [@​ldelossa](https://github.com/ldelossa); [cilium/cilium#37346](cilium/cilium#37346), [@​gyutaeb](https://github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](cilium/cilium#39304), [@​carlos-abad](https://github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](cilium/cilium#36351), [@​l1b0k](https://github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](cilium/cilium#38198), [@​dylandreimerink](https://github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](cilium/cilium#39987), [@​dylandreimerink](https://github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](cilium/cilium#38296), [cilium/cilium#39497](cilium/cilium#39497), [@​pchaigno](https://github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](cilium/cilium#39074), [@​pchaigno](https://github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](cilium/cilium#38249), [@​caorui-io](https://github.com/caorui-io), [@​kadevu](https://github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](cilium/cilium#38110), [@​gentoo-root](https://github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](cilium/cilium#38452), [@​rgo3](https://github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](cilium/cilium#39453), [@​antonipp](https://github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](cilium/cilium#39902), [@​squeed](https://github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](cilium/cilium#37634), [@​kaworu](https://github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](cilium/cilium#39338), [@​MrFreezeex](https://github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](cilium/cilium#36492), [cilium/cilium#37445](cilium/cilium#37445), [@​squeed](https://github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://github.com/marseel), [cilium/cilium#40227](cilium/cilium#40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](cilium/cilium#40005), [@​marseel](https://github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](cilium/cilium#39340), [@​squeed](https://github.com/squeed); [cilium/cilium#40414](cilium/cilium#40414), [@​marseel](https://github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](cilium/cilium#38596), [@​MrFreezeex](https://github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](cilium/cilium#36471), [@​HadrienPatte](https://github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](cilium/cilium#37714), [@​giorio94](https://github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](cilium/cilium#36288), [@​tommyp1ckles](https://github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](cilium/cilium#37601), [@​aditighag](https://github.com/aditighag); [cilium/cilium#38031](cilium/cilium#38031), [@​orange30](https://github.com/orange30); [cilium/cilium#36648](cilium/cilium#36648), [@​wedaly](https://github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](cilium/cilium#36510), [@​ovidiutirla](https://github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](cilium/cilium#38940), [@​christarazi](https://github.com/christarazi); [cilium/cilium#39090](cilium/cilium#39090), [@​pippolo84](https://github.com/pippolo84); [cilium/cilium#37765](cilium/cilium#37765), [@​rastislavs](https://github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](cilium/cilium#40137), [@​Murat](https://github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](cilium/cilium#39664), [@​aanm](https://github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](cilium/cilium#39124), [cilium/cilium#40175](cilium/cilium#40175), [cilium/cilium#39632](cilium/cilium#39632), [@​sayboras](https://github.com/sayboras); [cilium/cilium#38868](cilium/cilium#38868), [@​squeed](https://github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](cilium/cilium#38308), [@​julianwiedmann](https://github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](cilium/cilium#39590), [@​sayboras](https://github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](cilium/cilium#37792), [cilium/cilium#37402](cilium/cilium#37402), [cilium/cilium#40138](cilium/cilium#40138), [@​sayboras](https://github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](cilium/cilium#39922), [@​youngnick](https://github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](cilium/cilium#37798), [@​sayboras](https://github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](cilium/cilium#39678), [@​41ks](https://github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](cilium/cilium#39638), [@​pippolo84](https://github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](cilium/cilium#39442), [@​pippolo84](https://github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](cilium/cilium#38483), [@​pippolo84](https://github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](cilium/cilium#37275), [@​romanspb80](https://github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](cilium/cilium#36414), [@​dswaffordcw](https://github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](cilium/cilium#36451), [@​yushoyamaguchi](https://github.com/yushoyamaguchi); [cilium/cilium#38300](cilium/cilium#38300), [@​liyihuang](https://github.com/liyihuang)) #### 🧑💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](cilium/cilium#37027), [@​Joe](https://github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](cilium/cilium#40212), [@​squeed](https://github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](cilium/cilium#38480), [cilium/cilium#39642](cilium/cilium#39642), [cilium/cilium#37418](cilium/cilium#37418), [@​brb](https://github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1062 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
enchantednatures
pushed a commit
to enchantednatures/HomeCluster
that referenced
this pull request
Aug 5, 2025
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@​joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@​ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@​gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@​carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@​l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@​dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@​pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@​pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@​caorui-io](https://redirect.github.com/caorui-io), [@​kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@​gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@​rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@​antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@​squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@​kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@​squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@​marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@​marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@​squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@​marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@​MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@​HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@​giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@​tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@​aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@​orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@​wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@​ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@​christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@​pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@​rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@​Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@​aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@​sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@​squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@​julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@​sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@​sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@​youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@​sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@​41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@​pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@​pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@​pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@​romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@​dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@​yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@​liyihuang](https://redirect.github.com/liyihuang)) #### 🧑💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@​Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@​squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@​brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" in timezone America/New_York, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/enchantednatures/HomeCluster). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40Ni4zIiwidXBkYXRlZEluVmVyIjoiNDEuNDYuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvaGVsbSIsInR5cGUvbWlub3IiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes: #25135