Neighbor subsystem rework #39987

dylandreimerink · 2025-06-11T09:17:23Z

This PR reworks the code we have for managing neighbor entries in the kernel. At present this logic lives in the node manager and linux node handler.

When forwarding traffic in eBPF programs we use the FIB to find out to which L2 address we should forward that packet. The kernel uses the routing table to determine the next hop and the neighbor table to determine the L2 address of that nexthop. If no neighbor table entry exists for a given L3 address, the kernel would normally use something like ARP or ICMPv6 at that point to resolve one. This works in TC, but not XDP because in XDP context we are not allowed to delay processing of that packet to wait for the ARP/ICMPv6 resolution, and we have to drop the packet instead. So we need to ensure we always have neighbor entries for all possible next hops we would like to forward traffic to.

The existing logic had a few shortcomings:

On older kernel the agent has to re-create neighbor entries to refresh them, in case the L2 address of an IP changed. The old system was only able to do this for neighbor entries for node IPs not for service IPs.
The old system did not actively reconcile against the neighbor table, when neighbor entries were deleted by events such as a link carrier down, then it could take a long time before those entries were recreated
Changes to devices and routes were not processed, resulting in possible bad entries when device failover occurred or default gateways are changed at runtime
On agent startup, we would delete neighbor entries before desired neighbor entries were know. So we briefly removed all existing neighbor entries during restarts, causing short periods of traffic drops.

We want to address all of these by implementing the design as discussed in #38200. In short, we introduce the concept of a "Forwardable IP", each IP can have multiple owners. We query the kernel FIB for the next hop of each forwardable IP for each L2 device and de duplicate, the result are our "Desired Neighbors". We use the route and device stateDB table (also reflections of the kernel) to trigger recalculation of the desired neighbors. The desired neighbors are actively reconciled against the neighbor stateDB table which is reflection of the actual neighbor table. Refreshing of neighbor entries happens as part of the active feedback loop when needed.

This design ensure the neighbor table reconciles as fast as possible, while doing as little work as possible when no external events occur. We incidentally also make it very easy to inspect all of this state and to write powerful integration tests that verify proper cooperation between this new logic, the device controller and kernel.

Tip

Reviewers are encouraged to review commit-by-commit. Commit messages contain additional details.

Fixes: #38200
Fixes: #39499
Fixes: #38321
Fixes: #37431

Reworked the neighbor subsystem to be more resilient

gandro

Reviewed mainly for my code owners (which have trivial changes). I didn't look at most of the pkg/datapath code. Minor bits of feedback on the rest.

pkg/node/manager/node_config_notifier.go

install/kubernetes/cilium/values.yaml

dylandreimerink · 2025-06-11T10:44:38Z

/test

dylandreimerink · 2025-06-11T10:44:56Z

/scale-100

dylandreimerink · 2025-06-11T13:14:41Z

/test

dylandreimerink · 2025-06-11T15:36:27Z

/test

Copilot

Pull Request Overview

This PR reworks the neighbor subsystem to improve robustness and efficiency in managing neighbor entries and to remove deprecated ARP refresh logic. Key changes include:

Removal of unimplemented neighbor refresh functions in dummy node manager implementations.
Updates to configuration defaults and schema, disabling L2 neighbor discovery by default and removing obsolete ARP refresh options.
Modifications to the daemon initialization, cells registration, and documentation to align with the new neighbor management design.

Reviewed Changes

Copilot reviewed 65 out of 65 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/clustermesh/script_test.go	Removed unimplemented neighbor refresh methods from dummy node manager.
pkg/auth/authmap_gc.go	Removed a no-op NodeConfigurationChanged function.
install/kubernetes/cilium/values.yaml.tmpl	Updated l2NeighDiscovery config by disabling it and removing refreshPeriod.
install/kubernetes/cilium/values.yaml	Updated default for l2NeighDiscovery to false.
install/kubernetes/cilium/values.schema.json	Removed schema definitions for refreshPeriod.
install/kubernetes/cilium/templates/cilium-configmap.yaml	Removed configuration for ARP refresh period in the configmap.
Documentation/operations/upgrade.rst	Documented removal of obsolete configuration options and updated neighbor subsystem behavior.
Documentation/network/kubernetes/kubeproxy-free.rst	Revised neighbor discovery descriptions for clarity with XDP acceleration.
Documentation/helm-values.rst	Updated documented default value for l2NeighDiscovery.enabled.
Documentation/configuration/index.rst	Removed outdated arping-refresh-period setting from the configuration snippet.
Documentation/cmdref/*	Updated CLI flag defaults to reflect the new neighbor discovery defaults.
CODEOWNERS	Included new ownership entries for neighbor discovery and test utility directories.
.github/actions/cilium-config/action.yml	Added helm-set for l2NeighDiscovery.enabled to align with new defaults.
daemon/cmd/daemon_test.go	Registered new neighbor discovery cells in test suite.
daemon/cmd/daemon_main.go	Removed deprecated neighbor refresh and cleanup code.
daemon/cmd/daemon.go	Eliminated ARP refresh and managed neighbor support logic.
daemon/cmd/cells.go	Added neighbor discovery cell registration for forwardable IP handling.

Comments suppressed due to low confidence (1)

daemon/cmd/daemon_test.go:128

The identifier 'ForwarableIPCell' appears to contain a typo; consider renaming it to 'ForwardableIPCell' to match the documented concept of 'Forwardable IP'.

neighbor.ForwarableIPCell,

dylandreimerink · 2025-06-13T15:11:01Z

The identifier 'ForwarableIPCell' appears to contain a typo; consider renaming it to 'ForwardableIPCell' to match the documented concept of 'Forwardable IP'.

Its a nit, but its a valid nit. Will fix that.

dylandreimerink · 2025-06-13T15:22:29Z

/test

joestringer · 2025-06-13T19:14:00Z

Given the momentum on this PR and support from multiple committers and all the reviewers, it seems worthwhile to accept this as a release blocker and grant an exception to the feature freeze date. Personally I would not review or merge a PR this big, but I am not going to be the person standing in the way. I'll defer to you as a committer for what's best for this area of the tree.

The neighbor table had been added in the past but was behind a flag since there were no users of the table yet. Since we are planning on using the table now, lets remove this flag so the table always exists and is always populated from netlink. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

Before this change, the `db/show neighbors` output just contained a lot of numbers which needed to be manually converted. This commit adds logic so that the `db/show neighbors` output is human readable. These fields now print like: ``` [...] Type State Flags FlagsExt [...] DST REACHABLE EXT_LEARNED EXT_MANAGED [...] DST REACHABLE EXT_LEARNED EXT_MANAGED [...] LLADDR FAILED EXT_LEARNED EXT_MANAGED [...] DST REACHABLE EXT_LEARNED|ROUTER EXT_MANAGED [...] DST FAILED EXT_LEARNED EXT_MANAGED [...] DST STALE ROUTER NONE [...] DST STALE NONE NONE ``` Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

The `NodeHandler` interface contained the `NodeConfigurationChanged` method. The only caller of `NodeConfigurationChanged` is the loader which called the method on the instance `NodeHandler` that was provided via hive. The instance of `NodeHandler` provided to hive is `*linuxNodeHandler`. However in reality there are multiple implementations of `NodeHandler`. This wasn't a problem before, because `linuxNodeHandler` was the only one that implemented `NodeConfigurationChanged`. For the neighbor subsystem we want to have a new implementation of `NodeHandler` that also implements `NodeConfigurationChanged` and also gets signaled from the loader. Since the sub-set of implementations that use `NodeConfigurationChanged` is small, I decided to split the method out into a new interface `NodeConfigurationChangedHandler`. To allow multiple implementations of this new interface to be triggered `NodeConfigNotifier` was added. Impelementations of `NodeConfigurationChangedHandler` can register themselves with `NodeConfigNotifier` and will be called when the `NodeConfigurationChanged` method is called on the notifier which happens from the loader. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

This commit introduced the reworked neighbor subsystem logic. The neighbor logic that currently exists in the linux node handler was not designed with resilience in mind and was missing a few key features. The interface of the neighbor package towards the rest of the agent is in the form of "Forwardable IPs". Any component that wishes to guarantee that XDP can forward traffic to a given IP address can register such a forwardable IP. Since the same IP could be "owned" by multiple components (e.g. a service and node) we need some logic to manage that. The `ForwardableIPManager` is responsible for that, and all components have to go through it to register/remove their forwardable IPs. The `DesiredNeighborCalculator` takes forwardable IPs, L2 devices and the routing table as inputs and calculates the "Desired Neighbors". This works by checking the next hop for all permutations of forwardable IPs and L2 devices, then deduplicating the results. We can do a partial update when new forwardable IPs are added. We periodically do a full update to deal with removal of forwardable IPs. When the set of L2 devices changes or the contents of the routing table change, we also do a full update at once. Desired neighbors are reconciled to the kernel via a generic reconciler. The existing logic for creating neighbor table entries is reused. Entries can be kernel managed or agent managed, depending on the probed kernel support. In addition we have a "Neighbor refresher" job. It watches the neighbor statedb table for changes. When a agent managed entry goes stale, it triggers a refresh of the entry via the reconciler. This creates an active feedback loop instead of a recreating on a timer. The refresher also monitors for deletions of the neighbor entries. If we still desire a neighbor entry, it will be recreated. As final touch, we use the table initializer mechanism to ensure pruning of existing neighbor entries on startup only happens once all "sources" of forwardable IPs confirm that they have added their initial list of forwardable IPs. This ensures that we do not prune from the kernel neighbor table until we have an initial set of desired neighbors to reconcile. All of these features together eliminate a set of issues that happen when devices, routes and neighbors change outside of Cilium's control. We also eliminate issues where some entries were not being refreshed. PR #37352 made it so backends for services unconditionally get neighbor entries. This introduced a performance regression due to the amount of netlink calls to resolve next hops. We have inherited this performance regression which still exists in this new implementation. Strictly speaking we do not need to create the neighbor entries unless we are running XDP. So lets disable L2 neighbor discovery by default. When XDP is enabled, we automatically also enable neighbor discovery. When XDP is disabled, the user can still enable neighbor discovery by passing the `--enable-l2-neighbor-discovery` flag to the agent. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

This commit introduces a set of script commands that allow us to create ephemeral network topologies for script tests. The use case being that we want to test that the new neighbor reconciliation works and picks up neighbor entries getting stale. To be able to test this need to create some network namespaces, devices, routes, ect. Also key is that these should be ephemeral, work in parallel and be cleanup up after tests are done. We were not able to do with properly with `exec ip netns` since they use globally pinned network namespaces, so parallel tests interfere with each other and pinned namespaces are not cleaned up automatically. So `pkg/testutils/scriptnet` provides a set of commands to do operations we would normally use `ip` for. These commands are directly implemented in Go with netlink and are aware of ephemeral namespaces. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

This commit adds script based tests for the neighbor subsystem. The script runner create a hive with the neighbor subsystem and device/ route/neighbor tables and controllers. The scripts themselves test the integration of this subset of cells as well as the kernel. `desired-neighbors.txtar` tests that we properly calculate desired neighbors and react to changes like changes of devices, routes, and forwardable IPs. `neighbor-reconciler.txtar` tests that we properly reconcile desired neighbors and that we detect neighbors becoming stale and being refreshed by the agent. `neighbor-reconciler-kernel-arp.txtar` tests that we properly reconcile kernel managed neighbor entries and that they refresh without the agent. `neighbor-initialization.txtar` tests that we properly do initialization on startup and do not remove existing neighbors until we know we safely can. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

This commit hooks the new neighbor subsystem up to the node manager. We do this by create a new `NodeHandler` called `nodeNeighborHandler`. This handler gets registered with the node manager so we get informed when nodes are added or removed. This is similar to the existing mechanism but no longer part of the overloaded `linuxNodeHandler`. Node add/remove events are translated into forwardable IPs. The `nodeNeighborHandler` is also a `NodeConfigChangeHandler` and is registered at the `NodeConfigNotifier`. The `NodeConfigurationChanged` method is called when the loader reinitialized the datapath. And we use this as a proxy to know that all "nodes" have been added. This isn't ideal, but the same mechanism currently used by `linuxNodeHandler` because there is no better signal available at the moment. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

This commit hooks up the neighbor subsystem to the new loadbalancer logic. There currently exists a `syncBackendNeighbors` job which maps the backends table to `linuxNodeHandler` calls. We simply change that out of calls to the forwardable IP manager. Since we have access to the backends table, we can simply watch when that table is initialized and forward that to the forwardable IP initializer. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

All users of the old neighbor logic has been moved over to the new neighbor subsystem. This commit removes the old neighbor code. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

The `TestSetupIPIPDevices` test calls `setupIPIPDevices` which creates IPIP{4,6} devices. This implicitly causes kernel modules for these devices to be loaded. When that happens default behavior is to create "fallback" devices, not only in the main network namespace, but also in any network namespace that is created. This behavior can be changed with the `net.core.fb_tunnels_only_for_init_net` sysctl. In normal Cilium operation we set this sysctl to `2` which disabled this behavior. However, we have legacy/fallback code that renames these fallback devices and to test that rename code we run this test with a sysctl value of `0` which enables the fallback devices to be created in all network namespaces. This is problematic since it makes asserting on the state of the device table in unrelated tests difficult. Depending on if this test is executed in parallel with such tests or not. By default, `go test` runs tests in separate packages in parallel. Others have encountered similar issues in the past so we already have the `//go:build unparallel` build tag. This commit moves the `TestSetupIPIPDevices` test to a new file `netlink_unparallel_test.go` and adds the `//go:build unparallel` build tag to it. This ensures that this test is only ever run serialized. I also added cleanup code to change the sysctl value to `0` at the start of the test and to `2` at the end of the test. This ensures we always have the expected state during and after the test. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

dylandreimerink · 2025-06-14T09:53:18Z

/test

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | HelmChart | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@caorui-io](https://redirect.github.com/caorui-io), [@kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@liyihuang](https://redirect.github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/chezmoidotsh/arcane).

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | helm_release | minor | `1.17.6` -> `1.18.0` | | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@caorui-io](https://redirect.github.com/caorui-io), [@kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@liyihuang](https://redirect.github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/lambchop4prez/network).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…ilium ( 1.17.6 → 1.18.0 ) (#709) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/home-operations/charts-mirror/cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (ghcr.io/home-operations/charts-mirror/cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@caorui-io](https://redirect.github.com/caorui-io), [@kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@liyihuang](https://redirect.github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).  Co-authored-by: bot-nicole[bot] <205127124+bot-nicole[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@caorui-io](https://redirect.github.com/caorui-io), [@kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@liyihuang](https://redirect.github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rupaschomaker/home-cluster).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](cilium/cilium@1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](cilium/cilium#38469), [@joamaki](https://github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](cilium/cilium#37723), [@ldelossa](https://github.com/ldelossa); [cilium/cilium#37346](cilium/cilium#37346), [@gyutaeb](https://github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](cilium/cilium#39304), [@carlos-abad](https://github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](cilium/cilium#36351), [@l1b0k](https://github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](cilium/cilium#38198), [@dylandreimerink](https://github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](cilium/cilium#39987), [@dylandreimerink](https://github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](cilium/cilium#38296), [cilium/cilium#39497](cilium/cilium#39497), [@pchaigno](https://github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](cilium/cilium#39074), [@pchaigno](https://github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](cilium/cilium#38249), [@caorui-io](https://github.com/caorui-io), [@kadevu](https://github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](cilium/cilium#38110), [@gentoo-root](https://github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](cilium/cilium#38452), [@rgo3](https://github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](cilium/cilium#39453), [@antonipp](https://github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](cilium/cilium#39902), [@squeed](https://github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](cilium/cilium#37634), [@kaworu](https://github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](cilium/cilium#39338), [@MrFreezeex](https://github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](cilium/cilium#36492), [cilium/cilium#37445](cilium/cilium#37445), [@squeed](https://github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://github.com/marseel), [cilium/cilium#40227](cilium/cilium#40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](cilium/cilium#40005), [@marseel](https://github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](cilium/cilium#39340), [@squeed](https://github.com/squeed); [cilium/cilium#40414](cilium/cilium#40414), [@marseel](https://github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](cilium/cilium#38596), [@MrFreezeex](https://github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](cilium/cilium#36471), [@HadrienPatte](https://github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](cilium/cilium#37714), [@giorio94](https://github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](cilium/cilium#36288), [@tommyp1ckles](https://github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](cilium/cilium#37601), [@aditighag](https://github.com/aditighag); [cilium/cilium#38031](cilium/cilium#38031), [@orange30](https://github.com/orange30); [cilium/cilium#36648](cilium/cilium#36648), [@wedaly](https://github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](cilium/cilium#36510), [@ovidiutirla](https://github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](cilium/cilium#38940), [@christarazi](https://github.com/christarazi); [cilium/cilium#39090](cilium/cilium#39090), [@pippolo84](https://github.com/pippolo84); [cilium/cilium#37765](cilium/cilium#37765), [@rastislavs](https://github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](cilium/cilium#40137), [@Murat](https://github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](cilium/cilium#39664), [@aanm](https://github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](cilium/cilium#39124), [cilium/cilium#40175](cilium/cilium#40175), [cilium/cilium#39632](cilium/cilium#39632), [@sayboras](https://github.com/sayboras); [cilium/cilium#38868](cilium/cilium#38868), [@squeed](https://github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](cilium/cilium#38308), [@julianwiedmann](https://github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](cilium/cilium#39590), [@sayboras](https://github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](cilium/cilium#37792), [cilium/cilium#37402](cilium/cilium#37402), [cilium/cilium#40138](cilium/cilium#40138), [@sayboras](https://github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](cilium/cilium#39922), [@youngnick](https://github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](cilium/cilium#37798), [@sayboras](https://github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](cilium/cilium#39678), [@41ks](https://github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](cilium/cilium#39638), [@pippolo84](https://github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](cilium/cilium#39442), [@pippolo84](https://github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](cilium/cilium#38483), [@pippolo84](https://github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](cilium/cilium#37275), [@romanspb80](https://github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](cilium/cilium#36414), [@dswaffordcw](https://github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](cilium/cilium#36451), [@yushoyamaguchi](https://github.com/yushoyamaguchi); [cilium/cilium#38300](cilium/cilium#38300), [@liyihuang](https://github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](cilium/cilium#37027), [@Joe](https://github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](cilium/cilium#40212), [@squeed](https://github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](cilium/cilium#38480), [cilium/cilium#39642](cilium/cilium#39642), [cilium/cilium#37418](cilium/cilium#37418), [@brb](https://github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1062 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://redirect.github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://redirect.github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](https://redirect.github.com/cilium/cilium/pull/38469), [@joamaki](https://redirect.github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](https://redirect.github.com/cilium/cilium/pull/37723), [@ldelossa](https://redirect.github.com/ldelossa); [cilium/cilium#37346](https://redirect.github.com/cilium/cilium/pull/37346), [@gyutaeb](https://redirect.github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](https://redirect.github.com/cilium/cilium/pull/39304), [@carlos-abad](https://redirect.github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](https://redirect.github.com/cilium/cilium/pull/36351), [@l1b0k](https://redirect.github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](https://redirect.github.com/cilium/cilium/pull/38198), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](https://redirect.github.com/cilium/cilium/pull/39987), [@dylandreimerink](https://redirect.github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](https://redirect.github.com/cilium/cilium/pull/38296), [cilium/cilium#39497](https://redirect.github.com/cilium/cilium/pull/39497), [@pchaigno](https://redirect.github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](https://redirect.github.com/cilium/cilium/pull/39074), [@pchaigno](https://redirect.github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](https://redirect.github.com/cilium/cilium/pull/38249), [@caorui-io](https://redirect.github.com/caorui-io), [@kadevu](https://redirect.github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](https://redirect.github.com/cilium/cilium/pull/38110), [@gentoo-root](https://redirect.github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](https://redirect.github.com/cilium/cilium/pull/38452), [@rgo3](https://redirect.github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](https://redirect.github.com/cilium/cilium/pull/39453), [@antonipp](https://redirect.github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](https://redirect.github.com/cilium/cilium/pull/39902), [@squeed](https://redirect.github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](https://redirect.github.com/cilium/cilium/pull/37634), [@kaworu](https://redirect.github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](https://redirect.github.com/cilium/cilium/pull/39338), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](https://redirect.github.com/cilium/cilium/pull/36492), [cilium/cilium#37445](https://redirect.github.com/cilium/cilium/pull/37445), [@squeed](https://redirect.github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://redirect.github.com/marseel), [cilium/cilium#40227](https://redirect.github.com/cilium/cilium/pull/40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](https://redirect.github.com/cilium/cilium/pull/40005), [@marseel](https://redirect.github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](https://redirect.github.com/cilium/cilium/pull/39340), [@squeed](https://redirect.github.com/squeed); [cilium/cilium#40414](https://redirect.github.com/cilium/cilium/pull/40414), [@marseel](https://redirect.github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](https://redirect.github.com/cilium/cilium/pull/38596), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](https://redirect.github.com/cilium/cilium/pull/36471), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](https://redirect.github.com/cilium/cilium/pull/37714), [@giorio94](https://redirect.github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](https://redirect.github.com/cilium/cilium/pull/36288), [@tommyp1ckles](https://redirect.github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](https://redirect.github.com/cilium/cilium/pull/37601), [@aditighag](https://redirect.github.com/aditighag); [cilium/cilium#38031](https://redirect.github.com/cilium/cilium/pull/38031), [@orange30](https://redirect.github.com/orange30); [cilium/cilium#36648](https://redirect.github.com/cilium/cilium/pull/36648), [@wedaly](https://redirect.github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](https://redirect.github.com/cilium/cilium/pull/36510), [@ovidiutirla](https://redirect.github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](https://redirect.github.com/cilium/cilium/pull/38940), [@christarazi](https://redirect.github.com/christarazi); [cilium/cilium#39090](https://redirect.github.com/cilium/cilium/pull/39090), [@pippolo84](https://redirect.github.com/pippolo84); [cilium/cilium#37765](https://redirect.github.com/cilium/cilium/pull/37765), [@rastislavs](https://redirect.github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](https://redirect.github.com/cilium/cilium/pull/40137), [@Murat](https://redirect.github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](https://redirect.github.com/cilium/cilium/pull/39664), [@aanm](https://redirect.github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](https://redirect.github.com/cilium/cilium/pull/39124), [cilium/cilium#40175](https://redirect.github.com/cilium/cilium/pull/40175), [cilium/cilium#39632](https://redirect.github.com/cilium/cilium/pull/39632), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#38868](https://redirect.github.com/cilium/cilium/pull/38868), [@squeed](https://redirect.github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](https://redirect.github.com/cilium/cilium/pull/38308), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](https://redirect.github.com/cilium/cilium/pull/39590), [@sayboras](https://redirect.github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](https://redirect.github.com/cilium/cilium/pull/37792), [cilium/cilium#37402](https://redirect.github.com/cilium/cilium/pull/37402), [cilium/cilium#40138](https://redirect.github.com/cilium/cilium/pull/40138), [@sayboras](https://redirect.github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](https://redirect.github.com/cilium/cilium/pull/39922), [@youngnick](https://redirect.github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](https://redirect.github.com/cilium/cilium/pull/37798), [@sayboras](https://redirect.github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](https://redirect.github.com/cilium/cilium/pull/39678), [@41ks](https://redirect.github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](https://redirect.github.com/cilium/cilium/pull/39638), [@pippolo84](https://redirect.github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](https://redirect.github.com/cilium/cilium/pull/39442), [@pippolo84](https://redirect.github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](https://redirect.github.com/cilium/cilium/pull/38483), [@pippolo84](https://redirect.github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](https://redirect.github.com/cilium/cilium/pull/37275), [@romanspb80](https://redirect.github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](https://redirect.github.com/cilium/cilium/pull/36414), [@dswaffordcw](https://redirect.github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](https://redirect.github.com/cilium/cilium/pull/36451), [@yushoyamaguchi](https://redirect.github.com/yushoyamaguchi); [cilium/cilium#38300](https://redirect.github.com/cilium/cilium/pull/38300), [@liyihuang](https://redirect.github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](https://redirect.github.com/cilium/cilium/pull/37027), [@Joe](https://redirect.github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](https://redirect.github.com/cilium/cilium/pull/40212), [@squeed](https://redirect.github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](https://redirect.github.com/cilium/cilium/pull/38480), [cilium/cilium#39642](https://redirect.github.com/cilium/cilium/pull/39642), [cilium/cilium#37418](https://redirect.github.com/cilium/cilium/pull/37418), [@brb](https://redirect.github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://redirect.github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" in timezone America/New_York, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/enchantednatures/HomeCluster).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

dylandreimerink added kind/enhancement This would improve or streamline existing functionality. release-note/minor This PR changes functionality that users may find relevant to operating Cilium. resiliency Tracks resiliency issues labels Jun 11, 2025

dylandreimerink mentioned this pull request Jun 11, 2025

Neighbor subsystem rework #39869

Closed

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch from 1803dc5 to 6696cca Compare June 11, 2025 09:30

gandro reviewed Jun 11, 2025

View reviewed changes

pkg/node/manager/node_config_notifier.go Outdated Show resolved Hide resolved

pkg/node/manager/node_config_notifier.go Outdated Show resolved Hide resolved

install/kubernetes/cilium/values.yaml Outdated Show resolved Hide resolved

install/kubernetes/cilium/values.yaml Show resolved Hide resolved

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch from 6696cca to 4a48b6c Compare June 11, 2025 10:25

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch 2 times, most recently from e3f3116 to c47d5ab Compare June 11, 2025 11:59

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch 3 times, most recently from d98efe2 to 3bec706 Compare June 11, 2025 15:09

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch from 3bec706 to 64da38c Compare June 12, 2025 08:36

dylandreimerink requested review from borkmann, joamaki, marseel and christarazi June 12, 2025 08:38

dylandreimerink marked this pull request as ready for review June 12, 2025 08:39

dylandreimerink requested review from a team as code owners June 12, 2025 08:39

Copilot AI reviewed Jun 13, 2025

View reviewed changes

aanm approved these changes Jun 13, 2025

View reviewed changes

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch from 5acf1d2 to 3b5ce41 Compare June 13, 2025 15:08

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch from 3b5ce41 to aa210ea Compare June 13, 2025 15:13

dylandreimerink added 10 commits June 14, 2025 11:41

Remove old neighbor subsystem management code

8567a95

All users of the old neighbor logic has been moved over to the new neighbor subsystem. This commit removes the old neighbor code. Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>

dylandreimerink force-pushed the pr/dylandreimerink/neighbor-subsystem-rework branch from aa210ea to 2089631 Compare June 14, 2025 09:41

dylandreimerink added this pull request to the merge queue Jun 14, 2025

Merged via the queue into main with commit 94b7de5 Jun 14, 2025
311 of 315 checks passed

dylandreimerink deleted the pr/dylandreimerink/neighbor-subsystem-rework branch June 14, 2025 21:42

github-project-automation bot moved this from Proposed to Done in Release blockers Jun 14, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Neighbor subsystem rework #39987

Neighbor subsystem rework #39987

Uh oh!

dylandreimerink commented Jun 11, 2025 •

edited by borkmann

Loading

Uh oh!

gandro left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

dylandreimerink commented Jun 13, 2025 •

edited

Loading

Uh oh!

dylandreimerink commented Jun 13, 2025

Uh oh!

joestringer commented Jun 13, 2025

Uh oh!

dylandreimerink commented Jun 14, 2025

Uh oh!

Uh oh!

Uh oh!

Neighbor subsystem rework #39987

Neighbor subsystem rework #39987

Uh oh!

Conversation

dylandreimerink commented Jun 11, 2025 • edited by borkmann Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gandro left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

dylandreimerink commented Jun 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

dylandreimerink commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dylandreimerink commented Jun 13, 2025

Uh oh!

joestringer commented Jun 13, 2025

Uh oh!

dylandreimerink commented Jun 14, 2025

Uh oh!

Uh oh!

Uh oh!

dylandreimerink commented Jun 11, 2025 •

edited by borkmann

Loading

dylandreimerink commented Jun 13, 2025 •

edited

Loading