Summary of Changes Major Changes: bgp: support interface-based BGP unnumbered peering through autoDiscovery.mode: Unnumbered, discovering the peer's IPv6 link-local address on a configured interface and sending Router Advertisements for peer discovery. (#47394, @ecbaldwin) Enable BPF masquerading by default (#49411, @pchaigno) gateway-api: Add frontend client certificate validation (mTLS) support.…
Release v1.21.0-pre.4
Security patch release Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions. Summary of Changes Minor Changes: alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alo…
Security patch release Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions. Summary of Changes Bugfixes: CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references i…
Security patch release Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions. Summary of Changes Bugfixes: CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references i…
Release v1.20.4
Release v1.19.10
Release v1.18.16
Summary of Changes Minor Changes: alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR #49336, Upstream PR #49182, @4n4nd) Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR #49119, Upst…
Summary of Changes Bugfixes: endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #49000, Upstream PR #48272, @fristonio) Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49176, Upstream PR #48905, @fristonio) Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (…
Summary of Changes Bugfixes: Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49121, Upstream PR #48905, @fristonio) Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #49333, Upstream PR #49024, @maxskokov) Fix restoration of terminating backends. If a terminating backen…
Release v1.20.3
Release v1.19.9
Release v1.18.15
Summary of Changes Major Changes: LB IPAM: introduce the lbipam.cilium.io/sharing-permit-different-pods annotation to allow sharing an IP between services with externalTrafficPolicy=Local that select different pods. The annotation must be set to "true" on all services in the sharing group and is intended for deployments that steer traffic outside Cilium's built-in announcers. (#45819, @lexfrei) Mi…
Release v1.21.0-pre.3
Summary of Changes Minor Changes: gateway-api: node label selector for when hostNetwork is enabled (Backport PR #48636, Upstream PR #47463, @xtineskim) Bugfixes: aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #48418, Upstream PR #48125, @41ks) aws/ipam: Fixed a bug where the operator would fail to…
Summary of Changes Bugfixes: aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48604, Upstream PR #48193, @41ks) bpf: Fix agent crash when dumping map events (Backport PR #48379, Upstream PR #48273, @joestringer) bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport…
Summary of Changes Bugfixes: aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48607, Upstream PR #48193, @41ks) bpf: Fix agent crash when dumping map events (Backport PR #48380, Upstream PR #48273, @joestringer) datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Bac…
Release v1.19.8
Release v1.20.2
Release v1.18.14
Summary of Changes ⚠️ Due to a release issue, the v1.21.0-pre.1 has not been completed, instead we are publishing v1.21.0-pre.2. This changelog contains the changes from v1.21.0-pre.0 to v1.21.0-pre.2 Major Changes: Add support for Gateway API session persistence (#48029, @thorn3r) Allow use of AWS managed prefix lists in Cilium policies. (#45806, @bodgit) Enable BPF masquerading by default (#4763…
Release v1.21.0-pre.2
Release v1.21.0-pre.1
Release v1.21.0-pre.1
Summary of Changes Major Changes: docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #47615, Upstream PR #47351, @MrFreezeex) Minor Changes: envoy: demote stale ADS endpoint warning (Backport PR #47805, Upstream PR #47148, @nezdolik) Speed up recovery time for…
Summary of Changes Bugfixes: envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47688, Upstream PR #47583, @aanm) Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47723, Upstream PR #47765, @julianwiedmann) Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface…
Summary of Changes Major Changes: Add support for VRRP and IGMP protocols in host firewall (Backport PR #47619, Upstream PR #39872, @aditighag) Bugfixes: bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47619, Upstream PR #47343, @smagnani96) Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47687, Upstream PR #47552, @haozhangami) Fix potential hangs…
Release v1.20.1