Summary of Changes

Bugfixes:

• Policy updates to Envoy no longer consider a single selector as an L3 wildcard. Cilium bpf datapath policy enforcement is not done for Cilium Ingress policy enforcement so the L3 identity needs to be enforced in all cases. (Backport PR #39562, Upstream PR #39511, @jrajahalme)

CI Changes:

• bpf: test: fix up mis-spelled HAVE_NETNS_COOKIE (Backport PR #39562, Upstream PR #39420, @julianwiedmann)
• call for metrics in smoke tests from runner instead of installing apt/curl on cilium pod (Backport PR #39864, Upstream PR #37362, @Artyop)
• Re-optimize CI build process (Backport PR #39864, Upstream PR #39802, @aanm)

Misc Changes:

• [v1.15] deps: bump github.com/osrg/gobgp/v3 to v3.35.0 (#39224, @ferozsalam)
• Add a section to talk about the native routing masquerading in the cloud environment. (Backport PR #39562, Upstream PR #39343, @liyihuang)
• bpf: Skip lxc src IP check for proxy traffic (Backport PR #39562, Upstream PR #39530, @sayboras)
• chore(deps): update all github action dependencies (v1.15) (#39479, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#39572, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#39710, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#39881, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v31 (v1.15) (#39612, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.3 docker digest to 4c0a181 (v1.15) (#39708, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.3 docker digest to 86b4cff (v1.15) (#39611, @cilium-renovate[bot])
• chore(deps): update go to v1.24.4 (v1.15) (#39953, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1749031919-98c55b1d0c1154fb6c9e760583c2dcd7778686e2 (v1.15) (#39888, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1749271279-0864395884b263913eac200ee2048fd985f8e626 (v1.15) (#39937, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.15) (patch) (#39709, @cilium-renovate[bot])

Other Changes:

• [v1.15] proxy: Bump cilium/proxy version (#39592, @sayboras)
• install: Update image digests for v1.15.17 (#39546, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.18@sha256:106bb45c89e1e0abca82c798b16ccc1f5b1c6cfa1205d811b69989fd1507fc5b

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.18@sha256:66cb9687dd45c4d014f5d31186cb5609c13183d5a04352d2d9008e88329c59f0

docker-plugin

quay.io/cilium/docker-plugin:v1.15.18@sha256:9e205b34ffab2c7b7f9c8b0a7d4f97f2ebb61dd33f4fec061cf146835bcd3b18

hubble-relay

quay.io/cilium/hubble-relay:v1.15.18@sha256:a8a4337d518fafdd410dfc1d5cd2c1992f0406127d12ed8fcd683ed55e1e9db0

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.18@sha256:cefdfcda5a99703024a9d718e69d206844b5f745e4752eeb29797fdb5f19d905

operator-aws

quay.io/cilium/operator-aws:v1.15.18@sha256:126148f28186ab1704d8dd92d93aa06746f3a1f7c06e650735a32875415c5378

operator-azure

quay.io/cilium/operator-azure:v1.15.18@sha256:b705c0090b34611f75dc93caef52c7a52aa53a4f72a5fa39885fc08463197d93

operator-generic

quay.io/cilium/operator-generic:v1.15.18@sha256:ebc7a075ac4c3d95e98f11512853feb700e48f87b5beeff466128bdafb5e0cb9

operator

quay.io/cilium/operator:v1.15.18@sha256:e0c95bf661245a233b8ad5f0426f1e4ebc69192fc232c9a810577e35a3e43a51