fix(container): update quay.io/cilium/charts/cilium ( 1.20.0 ➔ 1.20.1 ) - abandoned #2011

Closed

renovate-bot wants to merge 4 commits from renovate/quay.io-cilium-charts-cilium-1.x into main

pull from: renovate/quay.io-cilium-charts-cilium-1.x

merge into: GiorgioAresu:main

GiorgioAresu:main

GiorgioAresu:renovate/ghcr.io-berriai-litellm-1.x

GiorgioAresu:renovate/siderolabs-talos-1.x

GiorgioAresu:renovate/public.ecr.aws-docker-library-redis-8.10.2

GiorgioAresu:renovate/docker.io-getmeili-meilisearch-1.x

GiorgioAresu:renovate/ghcr.io-coredns-charts-coredns-1.x

Conversation 3 Commits 4 Files changed 3 +3 -2

renovate-bot commented 2026-08-18 12:00:55 +02:00

Collaborator

Copy link

This PR contains the following updates:

Package	Update	Change
quay.io/cilium/charts/cilium (source)	patch	1.20.0 → 1.20.1

---

Release Notes

cilium/cilium (quay.io/cilium/charts/cilium)

v1.20.1: 1.20.1

Compare Source

Summary of Changes

Major Changes:

• docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #​47615, Upstream PR #​47351, @​MrFreezeex)

Minor Changes:

• envoy: demote stale ADS endpoint warning (Backport PR #​47805, Upstream PR #​47148, @​nezdolik)
• Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​47881, Upstream PR #​47529, @​julianwiedmann)

Bugfixes:

• azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #​47690, Upstream PR #​47449, @​jaredledvina)
• bpf: dsr: don't look for TCP header on fragmented packets (Backport PR #​47881, Upstream PR #​47640, @​julianwiedmann)
• bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #​47621, Upstream PR #​47343, @​smagnani96)
• clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #​47885, Upstream PR #​47824, @​MrFreezeex)
• datapath: turn ARP off on the base devices before bringing them up (Backport PR #​47885, Upstream PR #​47838, @​aanm)
• endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #​47690, Upstream PR #​47625, @​christarazi)
• endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #​47954, Upstream PR #​47880, @​weizhoublue)
• envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #​47885, Upstream PR #​47741, @​jdw6359)
• envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #​47690, Upstream PR #​47583, @​aanm)
• Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #​47805, Upstream PR #​47765, @​julianwiedmann)
• Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #​47967, Upstream PR #​47802, @​bimmlerd)
• Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #​47805, Upstream PR #​47727, @​aanm)
• Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #​47690, Upstream PR #​47295, @​aanm)
• Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #​47690, Upstream PR #​47552, @​haozhangami)
• Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #​47881, Upstream PR #​47593, @​julianwiedmann)
• fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR #​47885, Upstream PR #​47754, @​weizhoublue)
• Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #​47690, Upstream PR #​46842, @​pidreher)
• gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR #​47954, Upstream PR #​47840, @​mhofstetter)
• gateway-api: mark unresolved backend service ports in route status (Backport PR #​47885, Upstream PR #​47766, @​mhofstetter)
• gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR #​47690, Upstream PR #​46696, @​thorn3r)
• gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR #​47690, Upstream PR #​47457, @​asauber)
• gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR #​47805, Upstream PR #​47702, @​mhofstetter)
• gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR #​47690, Upstream PR #​47627, @​mhofstetter)
• ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #​47885, Upstream PR #​47208, @​iwanhae)
• l2announcer: re-evaluate services on frontend changes (Backport PR #​47690, Upstream PR #​47579, @​mhofstetter)
• Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #​47954, Upstream PR #​47826, @​mehrdadbn9)
• operator: Emit startup logs in the configured log format (Backport PR #​47954, Upstream PR #​47890, @​HadrienPatte)
• Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #​47885, Upstream PR #​47844, @​bimmlerd)
• standalone-dns-proxy: return an error when no endpoint is found (Backport PR #​47954, Upstream PR #​47791, @​vipul-21)
• wireguard: Unsubscribe node handler on shutdown (Backport PR #​47805, Upstream PR #​47614, @​HadrienPatte)

CI Changes:

• .github: add python3-scapy for BPF unit tests (Backport PR #​47690, Upstream PR #​47535, @​msune)
• .github: run all quarantined EKS tests in a single tolerated step (Backport PR #​47690, Upstream PR #​47534, @​aanm)
• .github: Run envoy image check against PR content (Backport PR #​47805, Upstream PR #​47792, @​joestringer)
• .github: Simplify permissions for image linter workflow (Backport PR #​47805, Upstream PR #​47753, @​joestringer)
• .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #​47690, Upstream PR #​47470, @​atykhyy)
• .github: test the default ENI behaviour on the EKS pull request leg (Backport PR #​47690, Upstream PR #​47569, @​aanm)
• ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #​47805, Upstream PR #​47743, @​giorio94)
• bpf/complexity-tests: Cover L7 LB (Backport PR #​47805, Upstream PR #​47060, @​pchaigno)
• ci: build race images on push events so conformance-race works on stable branches (Backport PR #​47609, Upstream PR #​47608, @​aanm)
• ci: build race images on push in the stable image builders (Backport PR #​47609, Upstream PR #​47616, @​aanm)
• ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #​47805, Upstream PR #​47364, @​mhofstetter)
• ci: fix filtering out md files in bpf checks (Backport PR #​47690, Upstream PR #​47605, @​nebril)
• ci: migrate set-commit-status to cilium/actions (Backport PR #​47805, Upstream PR #​47771, @​bogdankrasko)
• ci: skip etcd log fetch when kvstore was never started (Backport PR #​47885, Upstream PR #​47801, @​aanm)
• Fix missing events_map_rate_limit complexity coverage (Backport PR #​47805, Upstream PR #​47691, @​pchaigno)
• gha/kubespray: run on schedule, rather than on every push (Backport PR #​47731, Upstream PR #​47719, @​giorio94)
• gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #​47731, Upstream PR #​47703, @​giorio94)
• gha: don't install LLVM and Clang in integration tests workflow (Backport PR #​47731, Upstream PR #​47717, @​giorio94)
• gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR #​47731, Upstream PR #​47724, @​giorio94)
• images/scripts: Validate Envoy image vars against sed injection (Backport PR #​47805, Upstream PR #​47205, @​MasloMaslane)
• Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #​47885, Upstream PR #​47780, @​giorio94)
• test(bpf): parallelize eBPF test compilation (Backport PR #​47954, Upstream PR #​47426, @​lconnery)
• test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #​47805, Upstream PR #​47725, @​aanm)
• test: allowlist the leader election read timeout in ginkgo log check (Backport PR #​47690, Upstream PR #​47612, @​aanm)

Misc Changes:

• Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR #​47690, Upstream PR #​46116, @​amaanx86)
• allocator: fix flake in TestWatchRemoteKVStore (Backport PR #​47690, Upstream PR #​47455, @​giorio94)
• bpf/nat: Move IPv6 nat entry to map (Backport PR #​47805, Upstream PR #​47762, @​pchaigno)
• bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR #​47805, Upstream PR #​47582, @​dylandreimerink)
• bpf: dsr: only require DSR-info on SYN packet (Backport PR #​47881, Upstream PR #​47592, @​julianwiedmann)
• bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR #​47881, Upstream PR #​47388, @​julianwiedmann)
• bpf: lb: use dedicated new_backend bool (Backport PR #​47881, Upstream PR #​47841, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.20) (#​47991, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48008, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​47678, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) (#​47576, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (#​47988, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (#​47949, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (#​47864, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (#​47899, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (#​47989, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​47865, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​47990, @​cilium-renovate[bot])
• clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR #​47962, Upstream PR #​47932, @​giorio94)
• docs: clarify GAMMA DROP_EP_NOT_READY events (Backport PR #​47885, Upstream PR #​47587, @​thorn3r)
• docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR #​47690, Upstream PR #​47600, @​41ks)
• docs: Remove "not stable" installation instructions (Backport PR #​47798, Upstream PR #​47646, @​joestringer)
• docs: update Gateway API conformance badge (Backport PR #​47690, Upstream PR #​47581, @​arybolovlev)
• docs: Update Gateway API installation guide (Backport PR #​47690, Upstream PR #​47446, @​arybolovlev)
• Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR #​47690, Upstream PR #​47466, @​locker95)
• gateway-api: remove unnecessary TLSRoute support checks (Backport PR #​47885, Upstream PR #​47758, @​mhofstetter)
• gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR #​47690, Upstream PR #​47599, @​mhofstetter)
• gateway-api: return route check errors directly (Backport PR #​47805, Upstream PR #​47607, @​mhofstetter)
• gateway-api: unify Gateway API listener parentRef matching (Backport PR #​47690, Upstream PR #​46670, @​arybolovlev)
• gateway-api: validate gRPCRoute header modifiers in status (Backport PR #​47805, Upstream PR #​47606, @​mhofstetter)
• operator: Replace reflect.DeepEqual with assert.Equal in tests (Backport PR #​47690, Upstream PR #​47424, @​HadrienPatte)
• Update all github action dependencies (v1.20) (#​47656, @​cilium-renovate[bot])
• Update all github action dependencies (v1.20) (#​47675, @​cilium-renovate[bot])
• Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (#​47655, @​cilium-renovate[bot])
• Update documentation dependencies (Backport PR #​47798, Upstream PR #​47750, @​joestringer)
• Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (#​47657, @​cilium-renovate[bot])
• Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (#​47659, @​cilium-renovate[bot])
• Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (#​47658, @​cilium-renovate[bot])

Other Changes:

• install: Update image digests for v1.20.0 (#​47584, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b
quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5
quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5

hubble-relay

quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4
quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c
quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c

operator-aws

quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7
quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7

operator-azure

quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031
quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031

operator-generic

quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf
quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf

operator

quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d
quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](https://github.com/cilium/cilium/compare/1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#&#8203;47615](https://github.com/cilium/cilium/issues/47615), Upstream PR [#&#8203;47351](https://github.com/cilium/cilium/issues/47351), [@&#8203;MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47148](https://github.com/cilium/cilium/issues/47148), [@&#8203;nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#&#8203;47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#&#8203;47529](https://github.com/cilium/cilium/issues/47529), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47449](https://github.com/cilium/cilium/issues/47449), [@&#8203;jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#&#8203;47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#&#8203;47640](https://github.com/cilium/cilium/issues/47640), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#&#8203;47621](https://github.com/cilium/cilium/issues/47621), Upstream PR [#&#8203;47343](https://github.com/cilium/cilium/issues/47343), [@&#8203;smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47824](https://github.com/cilium/cilium/issues/47824), [@&#8203;MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47838](https://github.com/cilium/cilium/issues/47838), [@&#8203;aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47625](https://github.com/cilium/cilium/issues/47625), [@&#8203;christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#&#8203;47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#&#8203;47880](https://github.com/cilium/cilium/issues/47880), [@&#8203;weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47741](https://github.com/cilium/cilium/issues/47741), [@&#8203;jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47583](https://github.com/cilium/cilium/issues/47583), [@&#8203;aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47765](https://github.com/cilium/cilium/issues/47765), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#&#8203;47967](https://github.com/cilium/cilium/issues/47967), Upstream PR [#&#8203;47802](https://github.com/cilium/cilium/issues/47802), [@&#8203;bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47727](https://github.com/cilium/cilium/issues/47727), [@&#8203;aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47295](https://github.com/cilium/cilium/issues/47295), [@&#8203;aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47552](https://github.com/cilium/cilium/issues/47552), [@&#8203;haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#&#8203;47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#&#8203;47593](https://github.com/cilium/cilium/issues/47593), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47754](https://github.com/cilium/cilium/issues/47754), [@&#8203;weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;46842](https://github.com/cilium/cilium/issues/46842), [@&#8203;pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#&#8203;47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#&#8203;47840](https://github.com/cilium/cilium/issues/47840), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47766](https://github.com/cilium/cilium/issues/47766), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;46696](https://github.com/cilium/cilium/issues/46696), [@&#8203;thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47457](https://github.com/cilium/cilium/issues/47457), [@&#8203;asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47702](https://github.com/cilium/cilium/issues/47702), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47627](https://github.com/cilium/cilium/issues/47627), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47208](https://github.com/cilium/cilium/issues/47208), [@&#8203;iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47579](https://github.com/cilium/cilium/issues/47579), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#&#8203;47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#&#8203;47826](https://github.com/cilium/cilium/issues/47826), [@&#8203;mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#&#8203;47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#&#8203;47890](https://github.com/cilium/cilium/issues/47890), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47844](https://github.com/cilium/cilium/issues/47844), [@&#8203;bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#&#8203;47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#&#8203;47791](https://github.com/cilium/cilium/issues/47791), [@&#8203;vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47614](https://github.com/cilium/cilium/issues/47614), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47535](https://github.com/cilium/cilium/issues/47535), [@&#8203;msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47534](https://github.com/cilium/cilium/issues/47534), [@&#8203;aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47792](https://github.com/cilium/cilium/issues/47792), [@&#8203;joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47753](https://github.com/cilium/cilium/issues/47753), [@&#8203;joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47470](https://github.com/cilium/cilium/issues/47470), [@&#8203;atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47569](https://github.com/cilium/cilium/issues/47569), [@&#8203;aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47743](https://github.com/cilium/cilium/issues/47743), [@&#8203;giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47060](https://github.com/cilium/cilium/issues/47060), [@&#8203;pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#&#8203;47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#&#8203;47608](https://github.com/cilium/cilium/issues/47608), [@&#8203;aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#&#8203;47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#&#8203;47616](https://github.com/cilium/cilium/issues/47616), [@&#8203;aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47364](https://github.com/cilium/cilium/issues/47364), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47605](https://github.com/cilium/cilium/issues/47605), [@&#8203;nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47771](https://github.com/cilium/cilium/issues/47771), [@&#8203;bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47801](https://github.com/cilium/cilium/issues/47801), [@&#8203;aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47691](https://github.com/cilium/cilium/issues/47691), [@&#8203;pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#&#8203;47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#&#8203;47719](https://github.com/cilium/cilium/issues/47719), [@&#8203;giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#&#8203;47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#&#8203;47703](https://github.com/cilium/cilium/issues/47703), [@&#8203;giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#&#8203;47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#&#8203;47717](https://github.com/cilium/cilium/issues/47717), [@&#8203;giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#&#8203;47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#&#8203;47724](https://github.com/cilium/cilium/issues/47724), [@&#8203;giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47205](https://github.com/cilium/cilium/issues/47205), [@&#8203;MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47780](https://github.com/cilium/cilium/issues/47780), [@&#8203;giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#&#8203;47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#&#8203;47426](https://github.com/cilium/cilium/issues/47426), [@&#8203;lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47725](https://github.com/cilium/cilium/issues/47725), [@&#8203;aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47612](https://github.com/cilium/cilium/issues/47612), [@&#8203;aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;46116](https://github.com/cilium/cilium/issues/46116), [@&#8203;amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47455](https://github.com/cilium/cilium/issues/47455), [@&#8203;giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47762](https://github.com/cilium/cilium/issues/47762), [@&#8203;pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47582](https://github.com/cilium/cilium/issues/47582), [@&#8203;dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#&#8203;47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#&#8203;47592](https://github.com/cilium/cilium/issues/47592), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#&#8203;47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#&#8203;47388](https://github.com/cilium/cilium/issues/47388), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#&#8203;47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#&#8203;47841](https://github.com/cilium/cilium/issues/47841), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;47991](https://github.com/cilium/cilium/issues/47991), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48008](https://github.com/cilium/cilium/issues/48008), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;47678](https://github.com/cilium/cilium/issues/47678), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#&#8203;47576](https://github.com/cilium/cilium/issues/47576), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#&#8203;47988](https://github.com/cilium/cilium/issues/47988), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](https://github.com/cilium/cilium/commit/705e964) (v1.20) ([#&#8203;47949](https://github.com/cilium/cilium/issues/47949), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](https://github.com/cilium/cilium/commit/7caba52) (v1.20) ([#&#8203;47864](https://github.com/cilium/cilium/issues/47864), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#&#8203;47899](https://github.com/cilium/cilium/issues/47899), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#&#8203;47989](https://github.com/cilium/cilium/issues/47989), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;47865](https://github.com/cilium/cilium/issues/47865), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;47990](https://github.com/cilium/cilium/issues/47990), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#&#8203;47962](https://github.com/cilium/cilium/issues/47962), Upstream PR [#&#8203;47932](https://github.com/cilium/cilium/issues/47932), [@&#8203;giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47587](https://github.com/cilium/cilium/issues/47587), [@&#8203;thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47600](https://github.com/cilium/cilium/issues/47600), [@&#8203;41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#&#8203;47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#&#8203;47646](https://github.com/cilium/cilium/issues/47646), [@&#8203;joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47581](https://github.com/cilium/cilium/issues/47581), [@&#8203;arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47446](https://github.com/cilium/cilium/issues/47446), [@&#8203;arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47466](https://github.com/cilium/cilium/issues/47466), [@&#8203;locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#&#8203;47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#&#8203;47758](https://github.com/cilium/cilium/issues/47758), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47599](https://github.com/cilium/cilium/issues/47599), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47607](https://github.com/cilium/cilium/issues/47607), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;46670](https://github.com/cilium/cilium/issues/46670), [@&#8203;arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#&#8203;47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#&#8203;47606](https://github.com/cilium/cilium/issues/47606), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#&#8203;47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#&#8203;47424](https://github.com/cilium/cilium/issues/47424), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#&#8203;47656](https://github.com/cilium/cilium/issues/47656), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#&#8203;47675](https://github.com/cilium/cilium/issues/47675), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](https://github.com/cilium/cilium/commit/dc2d74b) (v1.20) ([#&#8203;47655](https://github.com/cilium/cilium/issues/47655), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#&#8203;47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#&#8203;47750](https://github.com/cilium/cilium/issues/47750), [@&#8203;joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#&#8203;47657](https://github.com/cilium/cilium/issues/47657), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#&#8203;47659](https://github.com/cilium/cilium/issues/47659), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#&#8203;47658](https://github.com/cilium/cilium/issues/47658), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#&#8203;47584](https://github.com/cilium/cilium/issues/47584), [@&#8203;cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNy4xIiwidXBkYXRlZEluVmVyIjoiNDQuMTcuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9wYXRjaCJdfQ==-->

renovate-bot added the

renovate/container

type/patch

labels 2026-08-18 12:00:55 +02:00

renovate-bot added 1 commit 2026-08-18 12:00:55 +02:00

fix(container): update quay.io/cilium/charts/cilium ( 1.20.0 ➔ 1.20.1 ) ... cb46a5e0a0

| datasource | package                      | from   | to     |
| ---------- | ---------------------------- | ------ | ------ |
| docker     | quay.io/cilium/charts/cilium | 1.20.0 | 1.20.1 |

lab-assistant-bot commented 2026-08-18 12:01:41 +02:00

Collaborator

Copy link

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Approve — clean patch-level Cilium Helm chart update from 1.20.0 → 1.20.1.

Changed files:

• kubernetes/bootstrap/helmfile.d/01-apps.yaml — single-line version bump

Konflate rendered diff: no findings, render succeeded.

Caveat (non-blocking): Repository impact scan shows kubernetes/apps/kube-system/cilium/app/ocirepository.yaml still references tag: 1.20.0. This is likely the Cilium agent image tag managed by the Helm chart's values.yaml.gotmpl. Helm charts typically pin their own container images internally — the OCI repository reference may be for an auxiliary image (e.g., CLI tooling) and not directly tied to the chart version. Verify if ocirepository.yaml should also be updated to 1.20.1 or whether it is intentionally decoupled.

Standards compliance: Version pinned by tag (convention for OCI artifacts); no @sha256: digest expected for Helm chart references. No sorting or formatting issues.

<!-- ai-pr-reviewer --> <!-- ai-pr-reviewer:{"version":1,"head_sha":"cb46a5e0a0998bcbdcf265b4a9ade15d315acadb","base_sha":"4b4eca780ca4f3075ac61c72d5f57c1cea654334","review_scope":"full","review_result":"clean"} --> <!-- ai-pr-review-sha:cb46a5e0a0998bcbdcf265b4a9ade15d315acadb --> <!-- ai-pr-review-fingerprint:80383c567bc34a38b1423aebfe3740b646f3de84|cfg:79332b18ceb4a39dfadfdbf642ce48bab94d2787e9924d2c56b8195d38d30ab7 --> ✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ **Approve** — clean patch-level Cilium Helm chart update from 1.20.0 → 1.20.1. **Changed files:** - `kubernetes/bootstrap/helmfile.d/01-apps.yaml` — single-line version bump **Konflate rendered diff:** no findings, render succeeded. **Caveat (non-blocking):** Repository impact scan shows `kubernetes/apps/kube-system/cilium/app/ocirepository.yaml` still references `tag: 1.20.0`. This is likely the Cilium agent image tag managed by the Helm chart's `values.yaml.gotmpl`. Helm charts typically pin their own container images internally — the OCI repository reference may be for an auxiliary image (e.g., CLI tooling) and not directly tied to the chart version. Verify if `ocirepository.yaml` should also be updated to `1.20.1` or whether it is intentionally decoupled. **Standards compliance:** Version pinned by tag (convention for OCI artifacts); no `@sha256:` digest expected for Helm chart references. No sorting or formatting issues.

forgejo-actions added the

area/bootstrap

area/kubernetes

labels 2026-08-18 12:01:49 +02:00

lab-assistant-bot commented 2026-08-18 12:17:04 +02:00

Collaborator

Copy link

konflate — summary

+0 added · 2 changed · −0 removed — 2 resources · 2 apps

Blast radius

• Kustomization network/envoy-gateway — 1 dependent (Kustomization network/envoy-gateway-gateway)

View the full rendered diff →

_{konflate · rendered cb46a5e · advisory, not a gate}

<!-- konflate:pr-2011 --> ### konflate — summary **+0 added · 2 changed · −0 removed** — 2 resources · 2 apps **Blast radius** - `Kustomization network/envoy-gateway` — 1 dependent (`Kustomization network/envoy-gateway-gateway`) [View the full rendered diff →](https://konflate.aresu.eu/#/pr/2011) _{konflate · rendered `cb46a5e` · advisory, not a gate}

renovate-bot force-pushed renovate/quay.io-cilium-charts-cilium-1.x from cb46a5e0a0 to 01963a80f8 2026-08-29 10:39:31 +02:00 Compare

renovate-bot changed title from fix(container): update quay.io/cilium/charts/cilium ( 1.20.0 ➔ 1.20.1 ) to fix(container): update quay.io/cilium/charts/cilium ( 1.20.0 ➔ 1.20.1 ) - abandoned 2026-08-31 23:00:45 +02:00

renovate-bot commented 2026-08-31 23:00:45 +02:00

Author

Collaborator

Copy link

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

### Autoclosing Skipped This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

GiorgioAresu closed this pull request 2026-08-31 23:32:31 +02:00

All checks were successful

Hide checks

Lint / actionlint (pull_request) Successful in 20s

Details

Lint / yamllint (pull_request) Successful in 28s

Details

AI PR Review / AI PR Review (pull_request) Successful in 48s

Details

Labeler / Labeler (pull_request) Successful in 54s

Details

Konflate 2 resources changed

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/bootstrap

  

area/ci

  

area/kubernetes

  

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

renovate/container

  

renovate/github-action

  

renovate/github-release

  

renovate/grafana-dashboard

  

renovate/helm

  

renovate/terraform

  

type/digest

  

type/major

  

type/minor

  

type/patch

  

wontfix

This will not be worked on

No labels

area/bootstrap

area/ci

area/kubernetes

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

renovate/container

renovate/github-action

renovate/github-release

renovate/grafana-dashboard

renovate/helm

renovate/terraform

type/digest

type/major

type/minor

type/patch

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GiorgioAresu/home-ops!2011

No description provided.