Summary of Changes Major Changes: Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value --envoy-xds-mode=delta-split. Corresponding Helm value is envoy.xdsMode=delta-split. (#45288, @jrajahalme) network driver: add agent side baseline driver and dummy dev…
Release v1.21.0-pre.0
🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release! More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩 ⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfi…
Release v1.20.0
Summary of Changes Major Changes: Cilium's Beta Mutual Auth support is now deprecated and will be removed in a future version. (Backport PR #47374, Upstream PR #47162, @youngnick) clustermesh: promote Multi-Cluster Services API (MCS-API) to a stable support level and improve its documentation (Backport PR #47374, Upstream PR #46953, @MrFreezeex) Minor Changes: envoy: reject CECs with duplicate fil…
Release v1.20.0-rc.1
Summary of Changes Minor Changes: datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #46845, Upstream PR #46332, @bersoare) gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev) Bugfixes: [v1.19] Fix policy service label se…
Summary of Changes Minor Changes: gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #47016, Upstream PR #46403, @arybolovlev) Bugfixes: Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47003, Upstream PR #46821, @fristonio) Fix regress…
Summary of Changes Bugfixes: Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47006, Upstream PR #46821, @fristonio) ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47199, Upstream PR #46867, @pippolo84) CI Changes: .github: Generate CI binaries with correct module version (Backport PR #47097, Upstream PR #46742,…
Release v1.19.6
Release v1.18.12
Release v1.17.18
Summary of Changes Minor Changes: Adds a new policy entity, cluster-mesh, which selects all endpoints in all meshed clusters. Also, makes the cluster and cluster-mesh create significantly fewer policy map entries. (#46813, @squeed) docs: add ListenerSet documentation (#46850, @asauber) The default CNI configuration version has been bumped from 0.3.1 to 1.0.0. Use the cni.customConf Helm value to s…
Release v1.20.0-rc.0
Summary of Changes Major Changes: (Beta) ENI IPAM mode with IPv6: The ENI IPAM mode now supports allocating and using IPv6 prefixes. (#46756, @41ks) As previously announced, docker libnetwork plugin as been sunset and is no longer available. (#46489, @aanm) envoy: Add ADS (Aggregated Discovery Service) server support (#43887, @nezdolik) gateway-api: Add TCPRoute and UDPRoute support (#46184, @emin…
Release v1.20.0-pre.4
Summary of Changes Minor Changes: Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #46554, Upstream PR #46516, @giorio94) helm: Remove loadBalancer.standalone option (Backport PR #46170, Upstream PR #46070, @joestringer) wireguard:mtu: fix mtu calculation with potential padding (Backport PR #46170, Upstream PR #45940, @smagnani96) Bugfixes: Always a…
Summary of Changes Minor Changes: Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #46555, Upstream PR #46516, @giorio94) Bugfixes: bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #46249, Upstream PR #45937, @nickolaev) datapath/mtu: add altname to mark cilium owned interfaces and do skip…
Summary of Changes Minor Changes: Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #46556, Upstream PR #46516, @giorio94) Bugfixes: multipool: Fix retries for CiliumNode Get errors (Backport PR #46413, Upstream PR #46124, @pippolo84) CI Changes: chore(deps): update lvh-images for conformance-runtime (Backport PR #46027, Upstream PR #45922, @julianwi…
Release v1.19.5
Release v1.18.11
Release v1.17.17
Summary of Changes Major Changes: Gateway API: ExternalAuth filter support for HTTPRoutes Cilium now supports the ExternalAuth filter type in HTTPRoutes (GEP-1494). Routes can delegate authorization decisions to an external service using either gRPC (Envoy ext_authz protocol) or HTTP. Configurable options include allowed request/response headers, request body forwarding, path prefix, and TLS-backe…
Release v1.20.0-pre.3
Release v1.19.4
Release v1.18.10