Summary of Changes Major Changes: LB IPAM: introduce the lbipam.cilium.io/sharing-permit-different-pods annotation to allow sharing an IP between services with externalTrafficPolicy=Local that select different pods. The annotation must be set to "true" on all services in the sharing group and is intended for deployments that steer traffic outside Cilium's built-in announcers. (#45819, @lexfrei) Mi…
Release v1.21.0-pre.3
Summary of Changes Minor Changes: gateway-api: node label selector for when hostNetwork is enabled (Backport PR #48636, Upstream PR #47463, @xtineskim) Bugfixes: aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #48418, Upstream PR #48125, @41ks) aws/ipam: Fixed a bug where the operator would fail to…
Summary of Changes Bugfixes: aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48604, Upstream PR #48193, @41ks) bpf: Fix agent crash when dumping map events (Backport PR #48379, Upstream PR #48273, @joestringer) bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport…
Summary of Changes Bugfixes: aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48607, Upstream PR #48193, @41ks) bpf: Fix agent crash when dumping map events (Backport PR #48380, Upstream PR #48273, @joestringer) datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Bac…
Release v1.19.8
Release v1.20.2
Release v1.18.14
Summary of Changes ⚠️ Due to a release issue, the v1.21.0-pre.1 has not been completed, instead we are publishing v1.21.0-pre.2. This changelog contains the changes from v1.21.0-pre.0 to v1.21.0-pre.2 Major Changes: Add support for Gateway API session persistence (#48029, @thorn3r) Allow use of AWS managed prefix lists in Cilium policies. (#45806, @bodgit) Enable BPF masquerading by default (#4763…
Release v1.21.0-pre.2
Release v1.21.0-pre.1
Release v1.21.0-pre.1
Summary of Changes Major Changes: docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #47615, Upstream PR #47351, @MrFreezeex) Minor Changes: envoy: demote stale ADS endpoint warning (Backport PR #47805, Upstream PR #47148, @nezdolik) Speed up recovery time for…
Summary of Changes Bugfixes: envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47688, Upstream PR #47583, @aanm) Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47723, Upstream PR #47765, @julianwiedmann) Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface…
Summary of Changes Major Changes: Add support for VRRP and IGMP protocols in host firewall (Backport PR #47619, Upstream PR #39872, @aditighag) Bugfixes: bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47619, Upstream PR #47343, @smagnani96) Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47687, Upstream PR #47552, @haozhangami) Fix potential hangs…
Release v1.20.1
Release v1.19.7
Release v1.18.13
Summary of Changes Major Changes: Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value --envoy-xds-mode=delta-split. Corresponding Helm value is envoy.xdsMode=delta-split. (#45288, @jrajahalme) network driver: add agent side baseline driver and dummy dev…
Release v1.21.0-pre.0
🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release! More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩 ⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfi…
Release v1.20.0
Summary of Changes Major Changes: Cilium's Beta Mutual Auth support is now deprecated and will be removed in a future version. (Backport PR #47374, Upstream PR #47162, @youngnick) clustermesh: promote Multi-Cluster Services API (MCS-API) to a stable support level and improve its documentation (Backport PR #47374, Upstream PR #46953, @MrFreezeex) Minor Changes: envoy: reject CECs with duplicate fil…
Release v1.20.0-rc.1
Summary of Changes Minor Changes: datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #46845, Upstream PR #46332, @bersoare) gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev) Bugfixes: [v1.19] Fix policy service label se…
Summary of Changes Minor Changes: gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #47016, Upstream PR #46403, @arybolovlev) Bugfixes: Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47003, Upstream PR #46821, @fristonio) Fix regress…
Summary of Changes Bugfixes: Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47006, Upstream PR #46821, @fristonio) ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47199, Upstream PR #46867, @pippolo84) CI Changes: .github: Generate CI binaries with correct module version (Backport PR #47097, Upstream PR #46742,…
Release v1.19.6
Release v1.18.12
Release v1.17.18