Update cilium to v1.20.2

[vshn-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	1.18.14 → 1.20.2

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

cilium/cilium (cilium)

v1.20.2: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

• gateway-api: node label selector for when hostNetwork is enabled (Backport PR #​48636, Upstream PR #​47463, @​xtineskim)

Bugfixes:

• aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #​48418, Upstream PR #​48125, @​41ks)
• aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #​48418, Upstream PR #​48193, @​41ks)
• bpf: Fix agent crash when dumping map events (Backport PR #​48378, Upstream PR #​48273, @​joestringer)
• bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #​48550, Upstream PR #​48407, @​41ks)
• Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #​48418, Upstream PR #​48262, @​giorio94)
• datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #​48550, Upstream PR #​46861, @​fdomain)
• endpoint: preserve concurrent policy updates for new endpoints (Backport PR #​48213, Upstream PR #​48195, @​jrajahalme)
• ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #​48213, Upstream PR #​47034, @​41ks)
• Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #​48418, Upstream PR #​47642, @​aanm)
• Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #​48024, Upstream PR #​47874, @​bryanhorstmann)
• Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #​48418, Upstream PR #​47971, @​ecbaldwin)
• Fix bug where identities may linger for double the amount of the expected time (Backport PR #​48418, Upstream PR #​48032, @​christarazi)
• Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #​48550, Upstream PR #​46399, @​yuito-it)
• Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #​48017, Upstream PR #​47943, @​taaahaaa)
• Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #​48017, Upstream PR #​47929, @​shreyasrajiv327)
• Fix Hubble Relay remains running during termination (Backport PR #​48550, Upstream PR #​47942, @​xandau)
• Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #​48418, Upstream PR #​48086, @​julianwiedmann)
• Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #​48418, Upstream PR #​48094, @​ecbaldwin)
• Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #​48418, Upstream PR #​48391, @​fristonio)
• Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #​48634, Upstream PR #​46638, @​ajmmm)
• Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #​48213, Upstream PR #​47945, @​dlanov)
• Fix nodeport egress tuple reuse for closed connections (Backport PR #​48418, Upstream PR #​48306, @​fristonio)
• Fix restored ENI endpoints routing rule configuration when masquerading config changes (#​48417, @​fristonio)
• fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #​48735, Upstream PR #​48624, @​kokhlo)
• Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #​48213, Upstream PR #​47915, @​giorio94)
• Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #​48735, Upstream PR #​48098, @​nashant)
• Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #​48434, Upstream PR #​47635, @​aanm)
• Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #​48213, Upstream PR #​48087, @​squeed)
• Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #​48213, Upstream PR #​48139, @​julianwiedmann)
• gateway-api: fix listener programmed status update (Backport PR #​48213, Upstream PR #​48013, @​mhofstetter)
• gateway-api: propgate listenerset status update errors (Backport PR #​48581, Upstream PR #​48130, @​mhofstetter)
• hubble: fix four config knobs that never reach their sink (Backport PR #​48434, Upstream PR #​47637, @​aanm)
• Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​48465, Upstream PR #​48254, @​julianwiedmann)
• lb (fix): require active state for backend when using topology hints (Backport PR #​48550, Upstream PR #​47054, @​CarrySauce)
• nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #​48603, Upstream PR #​48218, @​41ks)
• operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #​48213, Upstream PR #​47778, @​HadrienPatte)
• Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #​48213, Upstream PR #​48015, @​giorio94)
• The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #​48418, Upstream PR #​48174, @​julianwiedmann)
• When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #​48114, Upstream PR #​48053, @​julianwiedmann)

CI Changes:

• [v1.20] golangci-lint: Do not run the modernize linter (#​48398, @​aanm)
• .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #​48550, Upstream PR #​48462, @​joestringer)
• BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #​48213, Upstream PR #​47222, @​tommyp1ckles)
• bpf: tests: fix up prog type in ipv6_test (Backport PR #​48213, Upstream PR #​47736, @​julianwiedmann)
• bpf: tests: use PROG_TYPE (Backport PR #​48213, Upstream PR #​47714, @​julianwiedmann)
• bpf: tests: validate CT entry for DSR connection (Backport PR #​48418, Upstream PR #​48219, @​julianwiedmann)
• ci: replace unsupported LLVM installation action (Backport PR #​48418, Upstream PR #​47776, @​bogdankrasko)
• ci: resolve renovate PR metadata in base image workflows (Backport PR #​48213, Upstream PR #​47964, @​mhofstetter)
• ci: stop asking a PHP app for the AKS runner IP (Backport PR #​48418, Upstream PR #​48371, @​aanm)
• ci: use GitHub App client ID in v1.20 image workflow (Backport PR #​48213, Upstream PR #​47787, @​bogdankrasko)
• datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR #​48213, Upstream PR #​48037, @​tklauser)
• gh: verifier: test PR branch before base branch (Backport PR #​48418, Upstream PR #​47928, @​julianwiedmann)
• gha/conformance-aks: add a timeout to the cluster create step (Backport PR #​48550, Upstream PR #​48545, @​aanm)
• gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #​48550, Upstream PR #​48481, @​aanm)
• gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #​48213, Upstream PR #​48048, @​aanm)
• gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #​48213, Upstream PR #​48069, @​aanm)
• gha: compute the ginkgo cache key once, before the matrix (Backport PR #​48213, Upstream PR #​48127, @​aanm)
• gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #​48418, Upstream PR #​48352, @​aanm)
• gha: publish the external target hostnames as FQDNs (Backport PR #​48550, Upstream PR #​48478, @​aanm)
• gha: stop JUnit reports being destroyed by same-name legs (Backport PR #​48418, Upstream PR #​48203, @​aanm)
• logging: downgrade canceled response-body reads to info (Backport PR #​48418, Upstream PR #​48202, @​aanm)
• Makefile: Order the bpf codegen ahead of the Go builds (Backport PR #​48735, Upstream PR #​48644, @​aanm)
• Revert 48441 - disable local accounts on AKS clusters (#​48524, @​aanm)
• test(bpf): parallelize eBPF test execution (Backport PR #​48213, Upstream PR #​47427, @​lconnery)
• test/k8s: wait for the L7 visibility policy to be realized (Backport PR #​48418, Upstream PR #​48365, @​aanm)
• test: fix the never-taken retry on a partially read JSON line (Backport PR #​48634, Upstream PR #​48190, @​aanm)
• tools: complexity: de-couple StackDepth from kernel version (Backport PR #​48200, Upstream PR #​48236, @​julianwiedmann)
• workflows: disable local accounts on AKS clusters (#​48441, @​nbusseneau)

Misc Changes:

• Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #​48634, Upstream PR #​48421, @​0xch4z)
• bpf/lib/nat: rename icmpoff (Backport PR #​48418, Upstream PR #​47797, @​tommyp1ckles)
• bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (Backport PR #​48213, Upstream PR #​47392, @​julianwiedmann)
• bpf: icmp*: fix up sample length (Backport PR #​48114, Upstream PR #​48020, @​julianwiedmann)
• bpf: misc cleanups (Backport PR #​48350, Upstream PR #​47879, @​julianwiedmann)
• bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #​48284, Upstream PR #​46232, @​julianwiedmann)
• bpf: Reduce stack usage of send_trace_notify (Backport PR #​48350, Upstream PR #​47911, @​joamaki)
• chore(deps): update all external docker images dependencies (v1.20) (patch) (#​48147, @​cilium-renovate[bot])
• chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) (#​48673, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48326, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48506, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48677, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48149, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48325, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48619, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.20) (#​48327, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.20) (#​48672, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) (#​48729, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) (#​48344, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) (#​48505, @​cilium-renovate[bot])
• chore(deps): update dependency semver to v3.1.0 (v1.20) (#​48730, @​cilium-renovate[bot])
• chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) (#​48517, @​cilium-renovate[bot])
• chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) (#​48150, @​cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.0 (v1.20) (#​48591, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) (#​48323, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) (#​48451, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) (#​48674, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48148, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48324, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48504, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48675, @​cilium-renovate[bot])
• ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR #​48550, Upstream PR #​48375, @​0xch4z)
• datapath: move some feature probes into BPF (Backport PR #​48213, Upstream PR #​47737, @​julianwiedmann)
• docs: fix extra closing parenthesis in hive.rst (Backport PR #​48634, Upstream PR #​48541, @​logi74123)
• docs: Improve build process (Backport PR #​48550, Upstream PR #​47751, @​joestringer)
• docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #​48634, Upstream PR #​48487, @​ekoops)
• docs: Remove v1.18 ipsec documentation (Backport PR #​48418, Upstream PR #​48224, @​joestringer)
• docs: Update kernel config requirements (Backport PR #​48634, Upstream PR #​48594, @​pchaigno)
• Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #​48550, Upstream PR #​48428, @​marcus-chae)
• Documentation: document mesh security model (Backport PR #​48213, Upstream PR #​47912, @​bimmlerd)
• envoy: Clarify legacy UpdateEnvoyResources (Backport PR #​48213, Upstream PR #​48066, @​jrajahalme)
• Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR #​48350, Upstream PR #​47908, @​weizhoublue)
• Fix Component Overview doc link rendering (Backport PR #​48634, Upstream PR #​48537, @​eneiss)
• fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) (#​48118, @​cilium-renovate[bot])
• fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.20) (#​48388, @​cilium-renovate[bot])
• fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) (#​48676, @​cilium-renovate[bot])
• Fixed broken Slack link on Community page. (Backport PR #​48418, Upstream PR #​48021, @​ps-mir)
• Fixes: Update node-cache image version to 1.26.5 (Backport PR #​48634, Upstream PR #​48270, @​zyue110026)
• gateway-api: avoid logging missing GatewayClass as error (Backport PR #​48581, Upstream PR #​48529, @​mhofstetter)
• gateway-api: deduplicate condition merge helpers (Backport PR #​48581, Upstream PR #​48122, @​mhofstetter)
• gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR #​48581, Upstream PR #​48068, @​mhofstetter)
• gateway-api: extract gateway address status handling (Backport PR #​48581, Upstream PR #​48129, @​mhofstetter)
• gateway-api: extract index & load functionality from controller / reconcile (Backport PR #​48581, Upstream PR #​47837, @​mhofstetter)
• gateway-api: extract listener status handling (Backport PR #​48581, Upstream PR #​48103, @​mhofstetter)
• gateway-api: extract route status handling into RouteStatusManager (Backport PR #​48581, Upstream PR #​48023, @​mhofstetter)
• gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR #​48581, Upstream PR #​48191, @​mhofstetter)
• gateway-api: only load referenced services & serviceimports (Backport PR #​48581, Upstream PR #​48469, @​mhofstetter)
• gateway-api: put ctx first in route status API (Backport PR #​48581, Upstream PR #​48074, @​mhofstetter)
• gateway-api: remove duplicate gateway reconcile error logs (Backport PR #​48581, Upstream PR #​48186, @​mhofstetter)
• gateway-api: remove Gateway LBIPAM annotation warning (Backport PR #​48581, Upstream PR #​48187, @​mhofstetter)
• gateway-api: remove pre-filtered namespaces concept (Backport PR #​48581, Upstream PR #​47685, @​asauber)
• gha/lint-ariane-config: let Renovate manage the Go version (Backport PR #​48550, Upstream PR #​48467, @​aanm)
• gha: authenticate release images with OIDC (Backport PR #​48599, Upstream PR #​48062, @​aanm)
• gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #​48060, Upstream PR #​48061, @​aanm)
• gha: correct and move the OIDC subject comments (Backport PR #​48060, Upstream PR #​48370, @​aanm)
• gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #​48599, Upstream PR #​48535, @​aanm)
• helm: add general busybox image values for substitution (Backport PR #​48418, Upstream PR #​47973, @​0xch4z)
• vendor: Bump StateDB to v0.8.4 (#​48248, @​joamaki)

Other Changes:

• [v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() (#​48395, @​julianwiedmann)
• install: Update image digests for v1.20.1 (#​48039, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.2@​sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@​sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce
quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@​sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@​sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38
quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@​sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3
quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@​sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a
quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@​sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@​sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c
quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

v1.20.1: 1.20.1

Compare Source

Summary of Changes

Major Changes:

• docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #​47615, Upstream PR #​47351, @​MrFreezeex)

Minor Changes:

• envoy: demote stale ADS endpoint warning (Backport PR #​47805, Upstream PR #​47148, @​nezdolik)
• Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​47881, Upstream PR #​47529, @​julianwiedmann)

Bugfixes:

• azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #​47690, Upstream PR #​47449, @​jaredledvina)
• bpf: dsr: don't look for TCP header on fragmented packets (Backport PR #​47881, Upstream PR #​47640, @​julianwiedmann)
• bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #​47621, Upstream PR #​47343, @​smagnani96)
• clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #​47885, Upstream PR #​47824, @​MrFreezeex)
• datapath: turn ARP off on the base devices before bringing them up (Backport PR #​47885, Upstream PR #​47838, @​aanm)
• endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #​47690, Upstream PR #​47625, @​christarazi)
• endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #​47954, Upstream PR #​47880, @​weizhoublue)
• envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #​47885, Upstream PR #​47741, @​jdw6359)
• envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #​47690, Upstream PR #​47583, @​aanm)
• Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #​47805, Upstream PR #​47765, @​julianwiedmann)
• Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #​47967, Upstream PR #​47802, @​bimmlerd)
• Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #​47805, Upstream PR #​47727, @​aanm)
• Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #​47690, Upstream PR #​47295, @​aanm)
• Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #​47690, Upstream PR #​47552, @​haozhangami)
• Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #​47881, Upstream PR #​47593, @​julianwiedmann)
• fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR #​47885, Upstream PR #​47754, @​weizhoublue)
• Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #​47690, Upstream PR #​46842, @​pidreher)
• gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR #​47954, Upstream PR #​47840, @​mhofstetter)
• gateway-api: mark unresolved backend service ports in route status (Backport PR #​47885, Upstream PR #​47766, @​mhofstetter)
• gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR #​47690, Upstream PR #​46696, @​thorn3r)
• gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR #​47690, Upstream PR #​47457, @​asauber)
• gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR #​47805, Upstream PR #​47702, @​mhofstetter)
• gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR #​47690, Upstream PR #​47627, @​mhofstetter)
• ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #​47885, Upstream PR #​47208, @​iwanhae)
• l2announcer: re-evaluate services on frontend changes (Backport PR #​47690, Upstream PR #​47579, @​mhofstetter)
• Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #​47954, Upstream PR #​47826, @​mehrdadbn9)
• operator: Emit startup logs in the configured log format (Backport PR #​47954, Upstream PR #​47890, @​HadrienPatte)
• Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #​47885, Upstream PR #​47844, @​bimmlerd)
• standalone-dns-proxy: return an error when no endpoint is found (Backport PR #​47954, Upstream PR #​47791, @​vipul-21)
• wireguard: Unsubscribe node handler on shutdown (Backport PR #​47805, Upstream PR #​47614, @​HadrienPatte)

CI Changes:

• .github: add python3-scapy for BPF unit tests (Backport PR #​47690, Upstream PR #​47535, @​msune)
• .github: run all quarantined EKS tests in a single tolerated step (Backport PR #​47690, Upstream PR #​47534, @​aanm)
• .github: Run envoy image check against PR content (Backport PR #​47805, Upstream PR #​47792, @​joestringer)
• .github: Simplify permissions for image linter workflow (Backport PR #​47805, Upstream PR #​47753, @​joestringer)
• .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #​47690, Upstream PR #​47470, @​atykhyy)
• .github: test the default ENI behaviour on the EKS pull request leg (Backport PR #​47690, Upstream PR #​47569, @​aanm)
• ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #​47805, Upstream PR #​47743, @​giorio94)
• bpf/complexity-tests: Cover L7 LB (Backport PR #​47805, Upstream PR #​47060, @​pchaigno)
• ci: build race images on push events so conformance-race works on stable branches (Backport PR #​47609, Upstream PR #​47608, @​aanm)
• ci: build race images on push in the stable image builders (Backport PR #​47609, Upstream PR #​47616, @​aanm)
• ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #​47805, Upstream PR #​47364, @​mhofstetter)
• ci: fix filtering out md files in bpf checks (Backport PR #​47690, Upstream PR #​47605, @​nebril)
• ci: migrate set-commit-status to cilium/actions (Backport PR #​47805, Upstream PR #​47771, @​bogdankrasko)
• ci: skip etcd log fetch when kvstore was never started (Backport PR [#​47885](https://redirect.github.com/cilium/cil

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.