fix(helm): update cilium ( 1.18.4 → 1.18.7 ) by renovate[bot] · Pull Request #1191 · mebezac/home-cluster

renovate · 2025-12-17T14:45:03Z

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.18.4` → `1.18.7`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

`v1.18.7`: 1.18.7

Compare Source

Summary of Changes

Minor Changes:

Exclude topology.kubernetes.io labels from security labels by default (Backport PR #43777, Upstream PR #43725, @moscicky)
hubble-relay: Add hubble.relay.logOptions.format and hubble.relay.logOptions.level Helm values to configure log format (text, text-ts, json, json-ts) and level (debug, info, warn, error) (Backport PR #44004, Upstream PR #43644, @puwun)

Bugfixes:

Add permissions to the cilium-operator so that it can create EndpointSlices when the admission plugin OwnerReferencesPermissionEnforcement is activated (Backport PR #44034, Upstream PR #43912, @fgiloux)
bpf: Correct refinement of inner packet L4 checksum detection (Backport PR #43923, Upstream PR #43868, @br4243)
bpf: Fix marker to skip nodeport when punting to proxy (Backport PR #43886, Upstream PR #43069, @borkmann)
clustermesh: correctly phase out not ready/not service endpoints from global services (Backport PR #44056, Upstream PR #43807, @MrFreezeex)
Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #43756, Upstream PR #43095, @aditighag)
Fix ICMP error packet handling by adding the missing checksum recalculation performed during RevNAT for SNATed load-balanced traffic. (Backport PR #43861, Upstream PR #43196, @yushoyamaguchi)
Grant permissions to the cilium-operator so that it can reconcile ingresses when the when the admission plugin OwnerReferencesPermissionEnforcement is activated (Backport PR #44034, Upstream PR #43949, @giorio94)
helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals (Backport PR #44281, Upstream PR #44159, @puwun)
loadbalancer: Fix GetInstancesOfService to avoid removing an endpoint from Service A causes all requests to Service B to fail if the name of Service A is the prefix of Service B (Backport PR #43777, Upstream PR #43620, @imroc)
Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations (Backport PR #44281, Upstream PR #43517, @pasteley)

CI Changes:

fix(ctmap/gc): fix race conditions and flakiness in TestGCEnableRatchet (Backport PR #44056, Upstream PR #42009, @AritraDey-Dev)
gh: ariane: don't run cloud workflows for LVH kernel updates (Backport PR #44148, Upstream PR #44109, @julianwiedmann)
gh: ariane: skip more workflows for LVH kernel updates (Backport PR #44148, Upstream PR #44115, @julianwiedmann)
gha: let CiliumEndpointSlice migration be run nightly on stable branches (Backport PR #44004, Upstream PR #43921, @giorio94)
gke: lower scope of ESP firewall rule (Backport PR #43865, Upstream PR #43691, @marseel)

Misc Changes:

.github/workflows: use proper directory structure for GH actions (#43760, @aanm)
chore(deps): update all github action dependencies (v1.18) (#43845, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43984, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#44099, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#44253, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#43839, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43840, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43983, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#44098, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.0 (v1.18) (#43844, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.22.3 (v1.18) (#44096, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to b3255e7 (v1.18) (#44249, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to e226d63 (v1.18) (#43979, @cilium-renovate[bot])
chore(deps): update docker.io/library/ubuntu:24.04 docker digest to cd1dba6 (v1.18) (#43980, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to f9f84bd (v1.18) (#44250, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.3.2 (v1.18) (#43841, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1768610924-2528359430c6adba1ab20fc8396b4effe491ed96 (v1.18) (#43842, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1768828720-c6e4827ebca9c47af2a3a6540c563c30947bae29 (v1.18) (#43981, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770265024-9828c064a10df81f1939b692b01203d88bb439e4 (v1.18) (#44251, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770554954-8ce3bb4eca04188f4a0a1bfbd0a06a40f90883de (v1.18) (#44260, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43843, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43982, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#44097, @cilium-renovate[bot])
docs: add helm underlayProtocol value to documentation (Backport PR #44056, Upstream PR #43934, @aanm)
docs: adjust URL to latest stable Hubble CLI version (Backport PR #43777, Upstream PR #43745, @tklauser)
docs: Document hubble requirement on kernels with BPF_EVENTS compiled in (Backport PR #44056, Upstream PR #44042, @EmilyShepherd)
docs: Update docsearch to v4.5.4 (Backport PR #44273, Upstream PR #44233, @joestringer)
Documentation: Added Helm configuration instructions for enabling and customizing metrics. (Backport PR #44056, Upstream PR #43481, @suunj)
gitattributes: make install/kubernetes driver match more specific. (Backport PR #44056, Upstream PR #43943, @tommyp1ckles)
multicast: fix nil assignment to node configuration cell.Out map (Backport PR #43865, Upstream PR #40859, @ldelossa)
workflows: Add id-token permission to call-publish-helm job (Backport PR #43777, Upstream PR #43717, @aanm)

Other Changes:

.github/workflows: remove stable from v1.18 branch (#44153, @aanm)
[v1.18] Backport setup gke cluster (#43793, @Artyop)
install: Update image digests for v1.18.6 (#43714, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.7@sha256:3d4512153afc5d8ceda3517f9b243619b55a67f9abaebcc92c4be2df94d43cfa

docker-plugin

quay.io/cilium/docker-plugin:v1.18.7@sha256:e9f15016c7247dffeb2a9216cccc2ab6d36345a2504d34e319c6e9a7873bf3e9

hubble-relay

quay.io/cilium/hubble-relay:v1.18.7@sha256:9bb9b2b1a4f4bef12a77738756cfbf970daa701e536e42f0a9c64a621bc7c9d5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.7@sha256:ca3f0dd26a4b447524dce51ee8ef82485a08187b840c21ce4a1398c02b5174a0

operator-aws

quay.io/cilium/operator-aws:v1.18.7@sha256:fe56a6289afea7f6420f8de0218710ccaaa7af891df5fc180ddd33e6c7509b45

operator-azure

quay.io/cilium/operator-azure:v1.18.7@sha256:5fb753344c84ab0989d525f789738c874f3fa8f07fbb5cfce06034d027c9728f

operator-generic

quay.io/cilium/operator-generic:v1.18.7@sha256:244306c5e7c6b73dc7193424f46ed8a0530767b03f03baac80dd717a3a3f0ad7

operator

quay.io/cilium/operator:v1.18.7@sha256:8aa2bb32df776b8e8f6cfb57ab3eaed5a451bc9f20f1d62a2393840fc072678f

`v1.18.6`: 1.18.6

Compare Source

Summary of Changes

Major Changes:

Publish Helm charts to OCI registries (Backport PR #43689, Upstream PR #43624, @aanm)

Minor Changes:

Cilium Preflight check no longer includes Envoy Configmaps, making it easier to correctly run. (Backport PR #43290, Upstream PR #43153, @youngnick)
runtime: Add libatomic1 for cilium-envoy dependency (Backport PR #43642, Upstream PR #43292, @sayboras)

Bugfixes:

bpf:wireguard: delivery host packets to bpf_host for ingress policies (Backport PR #43690, Upstream PR #42892, @smagnani96)
cgroup: don't start watch if KPRConfig.EnableSocketLB is disabled (Backport PR #43290, Upstream PR #43256, @mhofstetter)
Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #43425, Upstream PR #43095, @aditighag)
Fix an issue in proxy NOTRACK iptables rule for aws-cni chaining mode which causes proxy->upstream(outside cluster) traffic not being SNAT'd. (Backport PR #43676, Upstream PR #43566, @fristonio)
Fix GC of possible duplicated identities in kvstore mode (Backport PR #43425, Upstream PR #43287, @giorio94)
Fixes a deadlock that was causing endpoint to be stuck without progressing with any updates. (Backport PR #43290, Upstream PR #43242, @marseel)
gateway-api: correctly handle CiliumGatewayClassConfig as a namespaced resource. (Backport PR #43290, Upstream PR #43254, @youngnick)
xds: fix nil-pointer in processRequestStream (Backport PR #43612, Upstream PR #43609, @mhofstetter)

CI Changes:

bpf: tests: egressgw: enable HostFW (Backport PR #43337, Upstream PR #42955, @julianwiedmann)
bpf: tests: egressgw: install ipcache_v6_add_world_entry() (Backport PR #43337, Upstream PR #42988, @julianwiedmann)
chore: comment job to use generated token instead of PAT (Backport PR #43612, Upstream PR #43148, @sekhar-isovalent)
ci: Use newer lvh image for privileged tests (Backport PR #43490, Upstream PR #41082, @rastislavs)

Misc Changes:

.github/workflows: remove auto-requested reviewers (Backport PR #43425, Upstream PR #42952, @aanm)
Add documentation and examples for using the egressDeny field in CiliumNetworkPolicy (Backport PR #43425, Upstream PR #40272, @syedazeez337)
bpf: clear mark content before storing the cluster ID (Backport PR #43290, Upstream PR #43159, @giorio94)
bpf: prevent cluster ID from being incorrectly retrieved from mark when aliased (Backport PR #43290, Upstream PR #43258, @giorio94)
chore(deps): update all github action dependencies (v1.18) (#43467, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43665, @cilium-renovate[bot])
chore(deps): update anchore/sbom-action action to v0.21.0 (v1.18) (#43512, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43543, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43664, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 2383baa (v1.18) (#43662, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.11 docker digest to 54528d1 (v1.18) (#43464, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.7 (v1.18) (#43465, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71 (v1.18) (#43539, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9 (v1.18) (#43638, @cilium-renovate[bot])
chore(deps): update rhysd/actionlint docker tag to v1.7.10 (v1.18) (#43541, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43466, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43542, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43571, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43663, @cilium-renovate[bot])
cmapisrv/test: miscellaneous fixes to the ciliumidentities script test (Backport PR #43425, Upstream PR #43372, @giorio94)
docs: Add missing IPv6 fragmentation BPF map reference (Backport PR #43290, Upstream PR #43161, @doniacld)
Fix a regression in the new services control plane where loadBalancerSourceRanges was applied by default to all service types. (Backport PR #43575, Upstream PR #42351, @borkmann)
operator: the K8s Secret synchronization process now resynchronizes after an hour for synced Secrets. (Backport PR #43425, Upstream PR #42414, @youngnick)
release: change OCI registry (Backport PR #43689, Upstream PR #43646, @aanm)
route: install ingress proxy routes with WireGuard and L7Proxy (Backport PR #43434, Upstream PR #42835, @smagnani96)

Other Changes:

[v1.18] bpf:hubble: support policy verdict from L3 devices (#43381, @smagnani96)
[v1.18] deps: bump CNI plugins version to v1.9.0 (#43593, @diyi0926)
install: Update image digests for v1.18.5 (#43400, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4
quay.io/cilium/cilium:stable@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.6@sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b
quay.io/cilium/clustermesh-apiserver:stable@sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b

docker-plugin

quay.io/cilium/docker-plugin:v1.18.6@sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f
quay.io/cilium/docker-plugin:stable@sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.6@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e
quay.io/cilium/hubble-relay:stable@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.6@sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c
quay.io/cilium/operator-alibabacloud:stable@sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c

operator-aws

quay.io/cilium/operator-aws:v1.18.6@sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb
quay.io/cilium/operator-aws:stable@sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb

operator-azure

quay.io/cilium/operator-azure:v1.18.6@sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1
quay.io/cilium/operator-azure:stable@sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1

operator-generic

quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af
quay.io/cilium/operator-generic:stable@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af

operator

quay.io/cilium/operator:v1.18.6@sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b
quay.io/cilium/operator:stable@sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b

`v1.18.5`: 1.18.5

Compare Source

Summary of Changes

Minor Changes:

[v1.18] proxy: Bump envoy version to v1.34.11 (#43143, @sayboras)
Change the sidecar etcd instance of the Cluster Mesh API Server listen on all IP addresses (Backport PR #42948, Upstream PR #42818, @giorio94)

Bugfixes:

allow missing verbs for cilium-agent cluster role when readSecretsOnlyFromSecretsNamespace is false (Backport PR #42948, Upstream PR #42790, @kraashen)
AWS EC2: Fix ENI attachment on multi-network card instances with high-performance networking (EFA) setups (Backport PR #42745, Upstream PR #42512, @41ks)
CiliumEnvoyConfig proxy ports are now restored on agent restarts. (Backport PR #43117, Upstream PR #43108, @jrajahalme)
Cleanup FQDNs that have leaked into the global FQDN cache (Backport PR #42864, Upstream PR #42485, @sjohnsonpal)
Do not opt-out Endpoint ID 1 from dnsproxy transparent mode. (Backport PR #42948, Upstream PR #42887, @jrajahalme)
ENI: Fix panic on nil subnet (Backport PR #43117, Upstream PR #43023, @HadrienPatte)
Ensure cilium-agent gracefully does fallbacks when etcd is in a bad state. (Backport PR #43059, Upstream PR #42977, @odinuge)
Fix a bug that would cause Cilium to not report L4 checksum update errors when the length attribute is missing in ICMP Error messages with TCP inner packets. (Backport PR #42828, Upstream PR #42426, @yushoyamaguchi)
Fix a bug that would cause IPsec logs to incorrectly report the XFRM rules being processed as "Ingress" rules. (Backport PR #42828, Upstream PR #42640, @sjohnsonpal)
Fix agent local identity leak (Backport PR #43117, Upstream PR #42662, @odinuge)
Fix bug that could cause the agent to fail to add XFRM states when IPsec is enabled, thus preventing a proper startup. (Backport PR #42948, Upstream PR #42666, @pchaigno)
Fix GC of per-cluster ctmap entries (Backport PR #43294, Upstream PR #43160, @giorio94)
Fix ipcache issues causing severe issues with the fqdn subsystem (Backport PR #42864, Upstream PR #42815, @odinuge)
Fix issue where endpoints got stuck in "waiting-to-regenerate" (Backport PR #42948, Upstream PR #42856, @odinuge)
Fix leak in the policy subsystem (Backport PR #43117, Upstream PR #42661, @odinuge)
Fix rare kvstore issue where cilium continues to use an expired lease causing kvstore operations to fail consistently (Backport PR #42745, Upstream PR #42709, @odinuge)
fqdn: Fix fqdn subsystem correctness issues causing packet drops and inconsistent ipcache (Backport PR #43117, Upstream PR #42500, @odinuge)
In rare cases, the cilium-operator losing the lead of the HA deployment could continue acting as if leading for at most a minute, leading to split-brain problems such as double allocation of pod CIDRs. (Backport PR #43059, Upstream PR #42920, @bimmlerd)
KVStoreMesh now correctly respects the CA bundle setting when validating remote cluster certificates (Backport PR #42828, Upstream PR #42726, @giorio94)
policy: Fix rare Endpoint Selector Policy Deadlock causing policies to not be updated with new identities (Backport PR #42864, Upstream PR #42306, @odinuge)
Recreate CiliumEndpoints (k8s resource) if they are accidentally deleted. (Backport PR #43117, Upstream PR #42877, @aanm)
redirectpolicy: Avoid recomputing on pod changes that do not change resulting redirect backends (Backport PR #42948, Upstream PR #42814, @joamaki)

CI Changes:

bpf: test: add BPF Masq tests for unknown / handled protocols (Backport PR #42711, Upstream PR #42144, @julianwiedmann)
bpf: test: egressgw: fix up ENABLE_MASQUERADE (Backport PR #42966, Upstream PR #42912, @julianwiedmann)
bpf: tests: add BPF MASQ test for ICMP ECHOs (Backport PR #42711, Upstream PR #42656, @julianwiedmann)
bpf: tests: set ENABLE_MASQUERADE_IPV6 for EGW XDP test (Backport PR #43059, Upstream PR #42962, @julianwiedmann)
bpf:test: cover host endpoint case in tc_nodeport_l3_dev.h (Backport PR #43059, Upstream PR #42983, @smagnani96)
Delete .github/workflows/build-images-hotfixes.yaml (Backport PR #42966, Upstream PR #42958, @sekhar-isovalent)
gh: conn-disrupt: fix XFRM error checks (Backport PR #42764, Upstream PR #42724, @julianwiedmann)
gh: ipsec-e2e: fix flaky connection disruptivity test (Backport PR #42823, Upstream PR #42780, @julianwiedmann)
gha: additionally cleanup disk space in clustermesh upgrade workflow (Backport PR #42948, Upstream PR #42862, @giorio94)
gha: don't filter lint-build-commits steps when workflow is modified (Backport PR #42948, Upstream PR #42844, @giorio94)
gha: wait for cert-manager CRDs to be ready in conformance clustermesh (Backport PR #42966, Upstream PR #42947, @giorio94)
makefile: More reliable update-helm-values (Backport PR #42828, Upstream PR #42736, @devodev)

Misc Changes:

.github/workflows: make adjustments for new GitHub workflow behavior (#43219, @aanm)
[v1.18] deps: bump x/crypto to v0.45.0 (#43114, @ferozsalam)
[v1.18] vendor: Bump to StateDB v0.4.6 (#42953, @joamaki)
chore(deps): update all github action dependencies (v1.18) (#42783, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#42937, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43036, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43181, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43268, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43317, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (patch) (#43314, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#42804, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#43037, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.18.9 (v1.18) (#43182, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.28 (v1.18) (#42771, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v33.1 (v1.18) (#42805, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v33.2 (v1.18) (#43184, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.11 (v1.18) (#43315, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to d80cd69 (v1.18) (#43312, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.10 docker digest to 7b13449 (v1.18) (#42935, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.10 docker digest to 83d7392 (v1.18) (#42802, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.11 docker digest to e3fb71a (v1.18) (#43313, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to 2b7c93f (v1.18) (#43135, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.6 (v1.18) (#42936, @cilium-renovate[bot])
chore(deps): update github artifact actions (v1.18) (#43318, @cilium-renovate[bot])
chore(deps): update go to v1.24.11 (v1.18) (#43183, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.3.1 (v1.18) (#43052, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#42803, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43316, @cilium-renovate[bot])
docs: Add limitation about LB to same backend via multiple VIPs (Backport PR #42745, Upstream PR #42632, @brb)
Documentation: host firewall: document emergency recovery (Backport PR #42948, Upstream PR #42776, @squeed)
fqdn: rewrite name manager test to use real ipcache (Backport PR #42948, Upstream PR #42820, @odinuge)
Minor improvements around certificate validation in etcd/clustermesh troubleshoot commands (Backport PR #42948, Upstream PR #42782, @giorio94)
node/manager: TestNodesStartupPruning poll state (Backport PR #42948, Upstream PR #41648, @0xch4z)
policy: Marshal L4Filter marshalling errors into json (Backport PR #42948, Upstream PR #42834, @joestringer)
xds: Do not log an error on a done context (Backport PR #43117, Upstream PR #42990, @jrajahalme)

Other Changes:

[v1.18] Add periodic resync for secret-sync controller (#43356, @youngnick)
[v1.18] bpf: lxc: transfer source identity for lxc-to-host policy (#42821, @julianwiedmann)
[v1.18] ipcache: Fix leak in CIDR metadata consolidation logic (#43354, @christarazi)
[v1.18] lb: Implement Hybrid-DSR via annotation infrastructure (#43056, @julianwiedmann)
[v1.18] proxy: Bump envoy version to v1.34.12 (#43259, @sayboras)
install: Update image digests for v1.18.4 (#42735, @cilium-release-bot[bot])
Kubernetes endpoints that are terminating are retained in the backends BPF state regardless of the "serving" condition to avoid connection disruptions when a pod no longer signals readiness to process new connections. (#42708, @joamaki)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
quay.io/cilium/cilium:stable@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.5@sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1
quay.io/cilium/clustermesh-apiserver:stable@sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1

docker-plugin

quay.io/cilium/docker-plugin:v1.18.5@sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f
quay.io/cilium/docker-plugin:stable@sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.5@sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446
quay.io/cilium/hubble-relay:stable@sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.5@sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c
quay.io/cilium/operator-alibabacloud:stable@sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c

operator-aws

quay.io/cilium/operator-aws:v1.18.5@sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52
quay.io/cilium/operator-aws:stable@sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52

operator-azure

quay.io/cilium/operator-azure:v1.18.5@sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6
quay.io/cilium/operator-azure:stable@sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6

operator-generic

quay.io/cilium/operator-generic:v1.18.5@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99
quay.io/cilium/operator-generic:stable@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99

operator

quay.io/cilium/operator:v1.18.5@sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606
quay.io/cilium/operator:stable@sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot added renovate/helm type/patch labels Dec 17, 2025

github-actions bot added the area/kubernetes label Dec 17, 2025

renovate bot force-pushed the renovate/cilium-1.18.x branch 5 times, most recently from 451a7a5 to 784e6ee Compare December 23, 2025 16:12

renovate bot force-pushed the renovate/cilium-1.18.x branch 5 times, most recently from 170cc61 to 4d240da Compare January 2, 2026 14:26

mebezac force-pushed the main branch from 2015932 to 28601fe Compare January 2, 2026 15:17

renovate bot force-pushed the renovate/cilium-1.18.x branch from 4d240da to c2f79a6 Compare January 2, 2026 18:05

mebezac force-pushed the main branch 3 times, most recently from d9d9789 to e2ed57a Compare January 4, 2026 22:55

renovate bot force-pushed the renovate/cilium-1.18.x branch 9 times, most recently from 81369cc to 840ed4a Compare January 12, 2026 17:42

renovate bot changed the title ~~fix(helm): update cilium ( 1.18.4 → 1.18.5 )~~ fix(helm): update cilium ( 1.18.4 → 1.18.6 ) Jan 13, 2026

mebezac force-pushed the main branch from e96725f to 0480522 Compare February 6, 2026 01:04

renovate bot force-pushed the renovate/cilium-1.18.x branch 7 times, most recently from c05b34c to 3fc3ad6 Compare February 13, 2026 22:24

renovate bot changed the title ~~fix(helm): update cilium ( 1.18.4 → 1.18.6 )~~ fix(helm): update cilium ( 1.18.4 → 1.18.7 ) Feb 13, 2026

renovate bot force-pushed the renovate/cilium-1.18.x branch 3 times, most recently from 818ea77 to efb971a Compare February 18, 2026 16:58

mebezac force-pushed the main branch 11 times, most recently from c9e09a3 to d36bc9f Compare February 20, 2026 17:33

renovate bot force-pushed the renovate/cilium-1.18.x branch from efb971a to 56d4577 Compare February 20, 2026 17:36

mebezac force-pushed the main branch from d36bc9f to 3924270 Compare February 20, 2026 17:43

renovate bot force-pushed the renovate/cilium-1.18.x branch from 56d4577 to 3767b0c Compare February 20, 2026 18:08

mebezac force-pushed the main branch from 0190008 to fec7607 Compare February 20, 2026 18:09

renovate bot force-pushed the renovate/cilium-1.18.x branch from 3767b0c to 4b24517 Compare February 23, 2026 16:48

fix(helm): update cilium ( 1.18.4 → 1.18.7 )

fcbb233

renovate bot force-pushed the renovate/cilium-1.18.x branch from 4b24517 to fcbb233 Compare February 27, 2026 02:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(helm): update cilium ( 1.18.4 → 1.18.7 )#1191

fix(helm): update cilium ( 1.18.4 → 1.18.7 )#1191
renovate[bot] wants to merge 1 commit intomainfrom
renovate/cilium-1.18.x

renovate bot commented Dec 17, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.18.7: 1.18.7

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.6: 1.18.6

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.5: 1.18.5

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Dec 17, 2025 •

edited

Loading

`v1.18.7`: 1.18.7

`v1.18.6`: 1.18.6

`v1.18.5`: 1.18.5