Summary of Changes

Minor Changes:

• helm: KPR subflag changes (Backport PR #40222, Upstream PR #39721, @brb)

Bugfixes:

• Deny policies are now synced to Envoy so that they can be enforced for Ingress policies. (Backport PR #40187, Upstream PR #39736, @jrajahalme)
• Do not fail the agent startup in case IPv6 support is enabled and the node does not have an IPv6 address assigned yet (Backport PR #40205, Upstream PR #40143, @pippolo84)
• Fix bug preventing a global service from including remote backends, if the local service has no selector, and the remote one gets removed and then added again. (#40361, @giorio94)
• Fix data race involving DumpReliablyWithCallback map operation. (Backport PR #40094, Upstream PR #38590, @aditighag)
• Fix IPAM IP release racing condition when IP reassigned back to ENI (Backport PR #40289, Upstream PR #40019, @victorcq)
• hubble automatically pick the hubble-prefer-ipv6 to true if ipv4 not enabled (Backport PR #40289, Upstream PR #40210, @chengjoey)
• LBIPAM: Fix deletion of CiliumLoadBalancerIPPool with multiple IP blocks that led to an operator crash (Backport PR #40094, Upstream PR #40013, @pippolo84)
• pkg/egressgateway: ensure gateway IP is IPv4 (Backport PR #40332, Upstream PR #40209, @rgo3)
• policy: fix error handling for selector policy resolution (#40404, @fristonio)

CI Changes:

• ci: do not run north-south conn disrupt tests for 5.4 kernels (#39443, @ldelossa)
• ci: fix north-south conn disrupt for 5.4 kernel (#40434, @smagnani96)

Misc Changes:

• .github/workflows: remove reviewers if ciliumbot approved PR (Backport PR #40094, Upstream PR #39989, @aanm)
• auto-approve: add repository as part command (Backport PR #40094, Upstream PR #40050, @aanm)
• auto-approve: add repository as part command (Backport PR #40332, Upstream PR #40089, @aanm)
• chore(deps): update all github action dependencies (v1.17) (#40158, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#40044, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#40458, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.18.5 (v1.17) (#39948, @cilium-renovate[bot])
• chore(deps): update go to v1.24.5 (v1.17) (#40424, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.4-1752151664-7c2edb0b44cf95f326d628b837fcdd845102ba68 (v1.17) (#40466, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#40157, @cilium-renovate[bot])
• cilium: fix socket termination for v4-in-v6 clients (Backport PR #40295, Upstream PR #39994, @borkmann)
• contrib/git: add merge drivers to automate post-merge commands (Backport PR #40289, Upstream PR #40189, @aanm)
• disk-cleanup: parallelize cleanup process to speed up step (Backport PR #40094, Upstream PR #40054, @aanm)
• doc:ipsec:kvstore: explicit limitations that could lead to staling XFRM states and no connectivity (Backport PR #40176, Upstream PR #39719, @smagnani96)
• docs/ipsec: Fix incorrect statement on hostns encryption (Backport PR #40176, Upstream PR #40133, @pchaigno)
• Makefile: Require API generation commands to succeed (Backport PR #40205, Upstream PR #40199, @joestringer)
• operator/secretsync: silence reconciliation logs (Backport PR #40289, Upstream PR #40217, @tklauser)
• proxy: Use upstream envoy control plane API (Backport PR #40216, Upstream PR #39672, @sayboras)
• v1.17: helm: Restore hostPort.enabled flag (#40480, @brb)

Other Changes:

• [v1.17] deps: Update cilium-envoy image to 1.33.x (#40088, @sayboras)
• Backport: kube-proxy-healthz to return 503 if node terminating (#40317, @tamilmani1989)
• Bpf datapath TCP conntrack entries are (re)created only in the forward direction, solving an issue with freezing proxy connections when backend connection is re-opened. (#40448, @jrajahalme)
• envoy: Bump cilium-envoy to the latest v1.33.x (#40368, @sayboras)
• install: Update image digests for v1.17.5 (#40117, @cilium-release-bot[bot])
• proxy: Bump envoy version to the latest v1.33.x (#40181, @sayboras)
• v1.17: docs: Document encapsulation options (#40471, @pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
quay.io/cilium/cilium:stable@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.6@sha256:f619e97432db427e1511bf91af3be8ded418c53a353a09629e04c5880659d1df
quay.io/cilium/clustermesh-apiserver:stable@sha256:f619e97432db427e1511bf91af3be8ded418c53a353a09629e04c5880659d1df

docker-plugin

quay.io/cilium/docker-plugin:v1.17.6@sha256:2d6175582c036dde241448b2b937353ce304d7a30eec9b66e96279b4b39c4f36
quay.io/cilium/docker-plugin:stable@sha256:2d6175582c036dde241448b2b937353ce304d7a30eec9b66e96279b4b39c4f36

hubble-relay

quay.io/cilium/hubble-relay:v1.17.6@sha256:7d17ec10b3d37341c18ca56165b2f29a715cb8ee81311fd07088d8bf68c01e60
quay.io/cilium/hubble-relay:stable@sha256:7d17ec10b3d37341c18ca56165b2f29a715cb8ee81311fd07088d8bf68c01e60

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.6@sha256:5352e670719dc61f059c1e1a04bc0563c2144738386fa7236dc167ff3fef4c64
quay.io/cilium/operator-alibabacloud:stable@sha256:5352e670719dc61f059c1e1a04bc0563c2144738386fa7236dc167ff3fef4c64

operator-aws

quay.io/cilium/operator-aws:v1.17.6@sha256:24db5c811e24e51e7ce166e8e056967875bf3544cc2ead6984f34f705fe71847
quay.io/cilium/operator-aws:stable@sha256:24db5c811e24e51e7ce166e8e056967875bf3544cc2ead6984f34f705fe71847

operator-azure

quay.io/cilium/operator-azure:v1.17.6@sha256:1b7e193ccbc718f723993a0f11eb8fbf16376e822fe8c4dc792d7696701d57c8
quay.io/cilium/operator-azure:stable@sha256:1b7e193ccbc718f723993a0f11eb8fbf16376e822fe8c4dc792d7696701d57c8

operator-generic

quay.io/cilium/operator-generic:v1.17.6@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096
quay.io/cilium/operator-generic:stable@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096

operator

quay.io/cilium/operator:v1.17.6@sha256:e7b41cdba20875f8a6595eca1baf1cff1b8367417cffa99be7b1b9b0a11ab677
quay.io/cilium/operator:stable@sha256:e7b41cdba20875f8a6595eca1baf1cff1b8367417cffa99be7b1b9b0a11ab677