Skip to content

feat(helm/cilium): update to v1.20.2 - #6764

Open
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/cilium
Open

feat(helm/cilium): update to v1.20.2#6764
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/cilium

Conversation

@tinfoild

@tinfoild tinfoild Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
cilium (source) HelmChart minor 1.19.4 → 1.20.2 OpenSSF Scorecard
cilium (source) minor 1.19.2 → 1.20.2 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

v1.20.2: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

  • aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #​48418, Upstream PR #​48125, @​41ks)
  • aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #​48418, Upstream PR #​48193, @​41ks)
  • bpf: Fix agent crash when dumping map events (Backport PR #​48378, Upstream PR #​48273, @​joestringer)
  • bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #​48550, Upstream PR #​48407, @​41ks)
  • Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #​48418, Upstream PR #​48262, @​giorio94)
  • datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #​48550, Upstream PR #​46861, @​fdomain)
  • endpoint: preserve concurrent policy updates for new endpoints (Backport PR #​48213, Upstream PR #​48195, @​jrajahalme)
  • ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #​48213, Upstream PR #​47034, @​41ks)
  • Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #​48418, Upstream PR #​47642, @​aanm)
  • Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #​48024, Upstream PR #​47874, @​bryanhorstmann)
  • Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #​48418, Upstream PR #​47971, @​ecbaldwin)
  • Fix bug where identities may linger for double the amount of the expected time (Backport PR #​48418, Upstream PR #​48032, @​christarazi)
  • Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #​48550, Upstream PR #​46399, @​yuito-it)
  • Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #​48017, Upstream PR #​47943, @​taaahaaa)
  • Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #​48017, Upstream PR #​47929, @​shreyasrajiv327)
  • Fix Hubble Relay remains running during termination (Backport PR #​48550, Upstream PR #​47942, @​xandau)
  • Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #​48418, Upstream PR #​48086, @​julianwiedmann)
  • Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #​48418, Upstream PR #​48094, @​ecbaldwin)
  • Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #​48418, Upstream PR #​48391, @​fristonio)
  • Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #​48634, Upstream PR #​46638, @​ajmmm)
  • Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #​48213, Upstream PR #​47945, @​dlanov)
  • Fix nodeport egress tuple reuse for closed connections (Backport PR #​48418, Upstream PR #​48306, @​fristonio)
  • Fix restored ENI endpoints routing rule configuration when masquerading config changes (#​48417, @​fristonio)
  • fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #​48735, Upstream PR #​48624, @​kokhlo)
  • Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #​48213, Upstream PR #​47915, @​giorio94)
  • Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #​48735, Upstream PR #​48098, @​nashant)
  • Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #​48434, Upstream PR #​47635, @​aanm)
  • Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #​48213, Upstream PR #​48087, @​squeed)
  • Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #​48213, Upstream PR #​48139, @​julianwiedmann)
  • gateway-api: fix listener programmed status update (Backport PR #​48213, Upstream PR #​48013, @​mhofstetter)
  • gateway-api: propgate listenerset status update errors (Backport PR #​48581, Upstream PR #​48130, @​mhofstetter)
  • hubble: fix four config knobs that never reach their sink (Backport PR #​48434, Upstream PR #​47637, @​aanm)
  • Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​48465, Upstream PR #​48254, @​julianwiedmann)
  • lb (fix): require active state for backend when using topology hints (Backport PR #​48550, Upstream PR #​47054, @​CarrySauce)
  • nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #​48603, Upstream PR #​48218, @​41ks)
  • operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #​48213, Upstream PR #​47778, @​HadrienPatte)
  • Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #​48213, Upstream PR #​48015, @​giorio94)
  • The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #​48418, Upstream PR #​48174, @​julianwiedmann)
  • When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #​48114, Upstream PR #​48053, @​julianwiedmann)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.20.2@​sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@​sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce
quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@​sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@​sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38
quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@​sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3
quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@​sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a
quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@​sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@​sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c
quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

v1.20.1: 1.20.1

Compare Source

Summary of Changes

Major Changes:

  • docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #​47615, Upstream PR #​47351, @​MrFreezeex)

Minor Changes:

Bugfixes:

CI Changes:

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Singapore)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying jjgadgets-biohazard with  Cloudflare Pages  Cloudflare Pages

Latest commit: 1ca9009
Status:🚫  Build failed.

View logs

@tinfoild

tinfoild Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

kube/helmrelease/out00

--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-dashboard

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-dashboard

@@ -8261,13 +8261,13 @@

             },
             {
               "datasource": {
                 "type": "prometheus",
                 "uid": ""
               },
-              "expr": "sum(cilium_policy_change_total{k8s_app=\"cilium\", pod=~\"\", outcome=\"fail\"}) by (pod)",
+              "expr": "sum(cilium_policy_change_total{k8s_app=\"cilium\", pod=~\"\", outcome=\"failure\"}) by (pod)",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "policy change errors",
               "refId": "D"
             }
           ],
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

@@ -52,32 +52,33 @@

   policy-deny-response: none
   enable-l7-proxy: 'true'
   enable-ipv4-masquerade: 'false'
   enable-ipv4-big-tcp: 'true'
   enable-ipv6-big-tcp: 'true'
   enable-ipv6-masquerade: 'true'
-  enable-tunnel-big-tcp: 'true'
   enable-tcx: 'true'
   datapath-mode: veth
   enable-masquerade-to-route-source: 'false'
   enable-xt-socket-fallback: 'true'
   install-no-conntrack-iptables-rules: 'false'
   iptables-random-fully: 'false'
   auto-direct-node-routes: 'true'
   direct-routing-skip-unreachable: 'true'
   enable-bandwidth-manager: 'true'
   enable-bbr: 'true'
   enable-bbr-hostns-only: 'false'
+  enable-host-firewall: 'false'
   devices: br0
   kube-proxy-replacement: 'true'
   kube-proxy-replacement-healthz-bind-address: 0.0.0.0:10256
   enable-no-service-endpoints-routable: 'true'
   bpf-lb-sock: 'true'
   bpf-lb-sock-hostns-only: 'true'
   nodeport-addresses: ''
   enable-health-check-nodeport: 'true'
+  enable-dynamic-source-lookup-nodeport: 'false'
   enable-health-check-loadbalancer-ip: 'false'
   node-port-bind-protection: 'true'
   enable-auto-protect-node-port-range: 'true'
   bpf-lb-mode: dsr
   bpf-lb-algorithm: maglev
   bpf-lb-acceleration: disabled
@@ -170,25 +171,34 @@

   proxy-max-requests-per-connection: '0'
   proxy-max-connection-duration-seconds: '0'
   proxy-idle-timeout-seconds: '60'
   proxy-max-concurrent-retries: '128'
   proxy-use-original-source-address: 'true'
   proxy-cluster-max-connections: '1024'
+  proxy-cluster-max-pending-requests: '1024'
   proxy-cluster-max-requests: '1024'
   http-retry-count: '3'
   http-stream-idle-timeout: '300'
+  envoy-node-locality-enabled: 'false'
   external-envoy-proxy: 'true'
   envoy-base-id: '0'
+  envoy-access-log-enabled: 'true'
   envoy-access-log-buffer-size: '4096'
   envoy-keep-cap-netbindservice: 'false'
+  envoy-xds-mode: ads
   max-connected-clusters: '255'
   clustermesh-cache-ttl: 0s
   clustermesh-enable-endpoint-sync: 'false'
   clustermesh-enable-mcs-api: 'false'
   clustermesh-mcs-api-install-crds: 'true'
+  clustermesh-default-global-namespace: 'true'
   policy-default-local-cluster: 'true'
   nat-map-stats-entries: '32'
   nat-map-stats-interval: 30s
   enable-lb-ipam: 'true'
   enable-non-default-deny-policies: 'true'
   enable-source-ip-verification: 'true'
+  enable-dynamic-config: 'true'
+  enable-drift-checker: 'true'
+  enable-datapath-plugins: 'false'
+  datapath-plugins-state-dir: /var/run/cilium/plugins
 
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-envoy-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-envoy-config

@@ -3,8 +3,8 @@

 kind: ConfigMap
 metadata:
   name: cilium-envoy-config
   namespace: kube-system
 data:
   bootstrap-config.json: |
-    {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}}
+    {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"adsConfig":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"cdsConfig":{"ads":{},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"ads":{},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}}
 
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium

+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium

@@ -25,13 +25,12 @@

 - apiGroups:
   - ''
   resources:
   - namespaces
   - services
   - pods
-  - endpoints
   - nodes
   verbs:
   - get
   - list
   - watch
 - apiGroups:
@@ -67,12 +66,13 @@

   - ciliumnetworkpolicies
   - ciliumnodes
   - ciliumnodeconfigs
   - ciliumcidrgroups
   - ciliuml2announcementpolicies
   - ciliumpodippools
+  - ciliumdatapathplugins
   verbs:
   - list
   - watch
 - apiGroups:
   - cilium.io
   resources:
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium-operator

@@ -54,21 +54,21 @@

   - patch
 - apiGroups:
   - ''
   resources:
   - namespaces
   - secrets
+  - serviceaccounts
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
   resources:
   - services
-  - endpoints
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - cilium.io
@@ -125,15 +125,18 @@

   - update
 - apiGroups:
   - cilium.io
   resources:
   - ciliumendpointslices
   - ciliumenvoyconfigs
+  - ciliumbgpclusterconfigs
+  - ciliumbgpnodeconfigoverrides
   - ciliumbgppeerconfigs
   - ciliumbgpadvertisements
   - ciliumbgpnodeconfigs
+  - ciliumcidrgroups
   verbs:
   - create
   - update
   - get
   - list
   - watch
@@ -180,20 +183,32 @@

   - ciliumnodes.cilium.io
   - ciliumnodeconfigs.cilium.io
   - ciliumcidrgroups.cilium.io
   - ciliuml2announcementpolicies.cilium.io
   - ciliumpodippools.cilium.io
   - ciliumgatewayclassconfigs.cilium.io
+  - ciliumdatapathplugins.cilium.io
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions/status
+  verbs:
+  - update
+  resourceNames:
+  - ciliumbgpclusterconfigs.cilium.io
+  - ciliumbgppeerconfigs.cilium.io
+  - ciliumbgpadvertisements.cilium.io
+  - ciliumbgpnodeconfigs.cilium.io
+  - ciliumbgpnodeconfigoverrides.cilium.io
 - apiGroups:
   - cilium.io
   resources:
   - ciliumloadbalancerippools
   - ciliumpodippools
-  - ciliumbgpclusterconfigs
-  - ciliumbgpnodeconfigoverrides
   - ciliumbgppeerconfigs
+  - ciliumdatapathplugins
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - cilium.io
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/hubble-ui

+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/hubble-ui

@@ -7,13 +7,12 @@

     app.kubernetes.io/part-of: cilium
 rules:
 - apiGroups:
   - ''
   resources:
   - componentstatuses
-  - endpoints
   - namespaces
   - nodes
   - pods
   - services
   verbs:
   - get
--- HelmRelease: kube-system/cilium Role: kube-system/cilium-operator-ztunnel

+++ HelmRelease: kube-system/cilium Role: kube-system/cilium-operator-ztunnel

@@ -14,7 +14,15 @@

   verbs:
   - create
   - delete
   - get
   - list
   - watch
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
 
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -16,13 +16,13 @@

     rollingUpdate:
       maxUnavailable: 2
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: d0bad4c00e267751c7ddc7b781018a786e4b0c16b180f87c1b249c9ead6c4ec4
+        cilium.io/cilium-configmap-checksum: 4b2e710dfcb83719eae2db15efac89b1beed33c298db93b0442a2f456cb0454d
         kubectl.kubernetes.io/default-container: cilium-agent
       labels:
         k8s-app: cilium
         app.kubernetes.io/name: cilium-agent
         app.kubernetes.io/part-of: cilium
     spec:
@@ -30,13 +30,13 @@

         appArmorProfile:
           type: Unconfined
         seccompProfile:
           type: Unconfined
       containers:
       - name: cilium-agent
-        image: quay.io/cilium/cilium:v1.19.2@sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341
+        image: quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
         imagePullPolicy: IfNotPresent
         command:
         - cilium-agent
         args:
         - --config-dir=/tmp/cilium/config-map
         startupProbe:
@@ -212,13 +212,13 @@

           mountPath: /tmp
         - name: hubble-flowlog-config
           mountPath: /flowlog-config
           readOnly: true
       initContainers:
       - name: config
-        image: quay.io/cilium/cilium:v1.19.2@sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341
+        image: quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
         imagePullPolicy: IfNotPresent
         command:
         - cilium-dbg
         - build-config
         - --k8s-api-server-urls=https://1:6443 https://2:6443 https://3:6443
         env:
@@ -240,19 +240,19 @@

           capabilities:
             add:
             - NET_ADMIN
             drop:
             - ALL
       - name: apply-sysctl-overwrites
-        image: quay.io/cilium/cilium:v1.19.2@sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341
+        image: quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
         imagePullPolicy: IfNotPresent
         env:
         - name: BIN_PATH
           value: /opt/cni/bin
         command:
-        - sh
+        - bash
         - -ec
         - |
           cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
           nsenter --mount=/hostproc/1/ns/mnt "/cilium-sysctlfix";
           rm /hostbin/cilium-sysctlfix
         volumeMounts:
@@ -270,13 +270,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: mount-bpf-fs
-        image: quay.io/cilium/cilium:v1.19.2@sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341
+        image: quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
         imagePullPolicy: IfNotPresent
         args:
         - mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
         command:
         - /bin/bash
         - -c
@@ -286,13 +286,13 @@

           privileged: true
         volumeMounts:
         - name: bpf-maps
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: quay.io/cilium/cilium:v1.19.2@sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341
+        image: quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
         imagePullPolicy: IfNotPresent
         command:
         - /init-container.sh
         env:
         - name: CILIUM_ALL_STATE
           valueFrom:
@@ -330,13 +330,13 @@

         - name: cilium-cgroup
           mountPath: /sys/fs/cgroup
           mountPropagation: HostToContainer
         - name: cilium-run
           mountPath: /var/run/cilium
       - name: install-cni-binaries
-        image: quay.io/cilium/cilium:v1.19.2@sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341
+        image: quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
         imagePullPolicy: IfNotPresent
         command:
         - /install-plugin.sh
         resources:
           limits:
             cpu: 1
@@ -358,12 +358,13 @@

       restartPolicy: Always
       priorityClassName: system-node-critical
       serviceAccountName: cilium
       automountServiceAccountToken: true
       terminationGracePeriodSeconds: 1
       hostNetwork: true
+      hostUsers: true
       affinity:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
           - labelSelector:
               matchLabels:
                 k8s-app: cilium
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy

@@ -28,13 +28,13 @@

     spec:
       securityContext:
         appArmorProfile:
           type: Unconfined
       containers:
       - name: cilium-envoy
-        image: quay.io/cilium/cilium-envoy:v1.35.9-1773656288-7b052e66eb2cfc5ac130ce0a5be66202a10d83be@sha256:60031f39669542b21aedf05a3317d14e8d3ea48255790af039b315a1c9637361
+        image: quay.io/cilium/cilium-envoy:v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82@sha256:af7382699576b9e65e9184efa52eeca0b58aea70ad6e511bf260c91d9f740463
         imagePullPolicy: IfNotPresent
         command:
         - /usr/bin/cilium-envoy-starter
         args:
         - --
         - -c /var/run/cilium/envoy/bootstrap-config.json
@@ -47,31 +47,34 @@

             port: 9878
             scheme: HTTP
           failureThreshold: 105
           periodSeconds: 2
           successThreshold: 1
           initialDelaySeconds: 5
+          timeoutSeconds: 5
         livenessProbe:
           httpGet:
             host: 127.0.0.1
             path: /healthz
             port: 9878
             scheme: HTTP
           periodSeconds: 30
           successThreshold: 1
           failureThreshold: 10
+          initialDelaySeconds: 0
           timeoutSeconds: 5
         readinessProbe:
           httpGet:
             host: 127.0.0.1
             path: /healthz
             port: 9878
             scheme: HTTP
           periodSeconds: 30
           successThreshold: 1
           failureThreshold: 3
+          initialDelaySeconds: 0
           timeoutSeconds: 5
         env:
         - name: K8S_NODE_NAME
           valueFrom:
             fieldRef:
               apiVersion: v1
@@ -119,12 +122,13 @@

       restartPolicy: Always
       priorityClassName: system-node-critical
       serviceAccountName: cilium-envoy
       automountServiceAccountToken: true
       terminationGracePeriodSeconds: 1
       hostNetwork: true
+      hostUsers: true
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
               - key: cilium.io/no-schedule
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -20,25 +20,25 @@

       maxSurge: 25%
       maxUnavailable: 50%
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: d0bad4c00e267751c7ddc7b781018a786e4b0c16b180f87c1b249c9ead6c4ec4
+        cilium.io/cilium-configmap-checksum: 4b2e710dfcb83719eae2db15efac89b1beed33c298db93b0442a2f456cb0454d
       labels:
         io.cilium/app: operator
         name: cilium-operator
         app.kubernetes.io/part-of: cilium
         app.kubernetes.io/name: cilium-operator
     spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cilium-operator
-        image: quay.io/cilium/operator-generic:v1.19.2@sha256:e363f4f634c2a66a36e01618734ea17e7b541b949b9a5632f9c180ab16de23f0
+        image: quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
         imagePullPolicy: IfNotPresent
         command:
         - cilium-operator-generic
         args:
         - --config-dir=/tmp/cilium/config-map
         - --debug=
@@ -94,12 +94,13 @@

           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
         terminationMessagePolicy: FallbackToLogsOnError
       hostNetwork: true
+      hostUsers: true
       restartPolicy: Always
       priorityClassName: system-cluster-critical
       serviceAccountName: cilium-operator
       automountServiceAccountToken: true
       affinity:
         podAntiAffinity:
--- HelmRelease: kube-system/cilium Deployment: kube-system/hubble-relay

+++ HelmRelease: kube-system/cilium Deployment: kube-system/hubble-relay

@@ -34,18 +34,19 @@

       - name: hubble-relay
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
-        image: quay.io/cilium/hubble-relay:v1.19.2@sha256:9987c73bad48c987fd065185535fd15a6717cbe8a8caf7fc7ef0413532cf490e
+        image: quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
         imagePullPolicy: IfNotPresent
         command:
         - hubble-relay
         args:
         - serve
         ports:
@@ -69,12 +70,14 @@

           grpc:
             port: 4222
           initialDelaySeconds: 10
           failureThreshold: 20
           periodSeconds: 3
         volumeMounts:
+        - name: tmp-volume
+          mountPath: /tmp
         - name: config
           mountPath: /etc/hubble-relay
           readOnly: true
         - name: tls
           mountPath: /var/lib/hubble-relay/tls
           readOnly: true
@@ -91,12 +94,14 @@

               matchLabels:
                 k8s-app: cilium
             topologyKey: kubernetes.io/hostname
       nodeSelector:
         kubernetes.io/os: linux
       volumes:
+      - name: tmp-volume
+        emptyDir: {}
       - name: config
         configMap:
           name: hubble-relay-config
           items:
           - key: config.yaml
             path: config.yaml
--- HelmRelease: kube-system/cilium Deployment: kube-system/hubble-ui

+++ HelmRelease: kube-system/cilium Deployment: kube-system/hubble-ui

@@ -26,19 +26,22 @@

         app.kubernetes.io/name: hubble-ui
         app.kubernetes.io/part-of: cilium
     spec:
       securityContext:
         fsGroup: 1001
         runAsGroup: 1001
+        runAsNonRoot: true
         runAsUser: 1001
+        seccompProfile:
+          type: RuntimeDefault
       priorityClassName: null
       serviceAccountName: hubble-ui
       automountServiceAccountToken: true
       containers:
       - name: frontend
-        image: quay.io/cilium/hubble-ui:v0.13.3@sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d
+        image: quay.io/cilium/hubble-ui:v0.13.6@sha256:049a80a03585c043d0c3121bdc518c72b0fd42bae07e4bcce0fdb8f1e88041d0
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
           containerPort: 8081
         livenessProbe:
           httpGet:
@@ -54,14 +57,17 @@

           subPath: nginx.conf
         - name: tmp-dir
           mountPath: /tmp
         terminationMessagePolicy: FallbackToLogsOnError
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
       - name: backend
-        image: quay.io/cilium/hubble-ui-backend:v0.13.3@sha256:db1454e45dc39ca41fbf7cad31eec95d99e5b9949c39daaad0fa81ef29d56953
+        image: quay.io/cilium/hubble-ui-backend:v0.13.6@sha256:83b3fc763f3d49948c306bf49b08277383e195904b9ca5c0c0022b2112628787
         imagePullPolicy: IfNotPresent
         env:
         - name: EVENTS_SERVER_PORT
           value: '8090'
         - name: FLOWS_API_ADDR
           value: hubble-relay:80
@@ -69,16 +75,20 @@

         - name: grpc
           containerPort: 8090
         volumeMounts: null
         terminationMessagePolicy: FallbackToLogsOnError
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
       nodeSelector:
         kubernetes.io/os: linux
       volumes:
       - configMap:
           defaultMode: 420
           name: hubble-ui-nginx
         name: hubble-ui-nginx-conf
       - name: tmp-dir
-        emptyDir: {}
+        emptyDir:
+          sizeLimit: 256Mi
 
--- HelmRelease: kube-system/cilium Job: kube-system/hubble-generate-certs-a1cef3bd19

+++ HelmRelease: kube-system/cilium Job: kube-system/hubble-generate-certs-a1cef3bd19

@@ -1,66 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: hubble-generate-certs-a1cef3bd19
-  namespace: kube-system
-  labels:
-    k8s-app: hubble-generate-certs
-    app.kubernetes.io/name: hubble-generate-certs
-    app.kubernetes.io/part-of: cilium
-spec:
-  template:
-    metadata:
-      labels:
-        k8s-app: hubble-generate-certs
-    spec:
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-      - name: certgen
-        image: quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-        command:
-        - /usr/bin/cilium-certgen
-        args:
-        - --ca-generate=true
-        - --ca-reuse-secret
-        - --ca-secret-namespace=kube-system
-        - --ca-secret-name=cilium-ca
-        - --ca-common-name=Cilium CA
-        env:
-        - name: CILIUM_CERTGEN_CONFIG
-          value: |
-            certs:
-            - name: hubble-server-certs
-              namespace: kube-system
-              commonName: "*.biohazard.hubble-grpc.cilium.io"
-              hosts:
-              - "*.biohazard.hubble-grpc.cilium.io"
-              usage:
-              - signing
-              - key encipherment
-              - server auth
-              - client auth
-              validity: 8760h
-            - name: hubble-relay-client-certs
-              namespace: kube-system
-              commonName: "*.hubble-relay.cilium.io"
-              hosts:
-              - "*.hubble-relay.cilium.io"
-              usage:
-              - signing
-              - key encipherment
-              - client auth
-              validity: 8760h
-      hostNetwork: false
-      serviceAccountName: hubble-generate-certs
-      automountServiceAccountToken: true
-      restartPolicy: OnFailure
-
--- HelmRelease: kube-system/cilium CronJob: kube-system/hubble-generate-certs

+++ HelmRelease: kube-system/cilium CronJob: kube-system/hubble-generate-certs

@@ -22,13 +22,13 @@

         spec:
           securityContext:
             seccompProfile:
               type: RuntimeDefault
           containers:
           - name: certgen
-            image: quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697
+            image: quay.io/cilium/certgen:v0.4.11@sha256:14d29a176fc96d15b154559ce1a5baf01367c10baabfa7bb8028b72f087a56f0
             imagePullPolicy: IfNotPresent
             securityContext:
               capabilities:
                 drop:
                 - ALL
               allowPrivilegeEscalation: false
@@ -37,12 +37,13 @@

             args:
             - --ca-generate=true
             - --ca-reuse-secret
             - --ca-secret-namespace=kube-system
             - --ca-secret-name=cilium-ca
             - --ca-common-name=Cilium CA
+            - --ca-enforce-validity-throughout-leaves-duration=true
             env:
             - name: CILIUM_CERTGEN_CONFIG
               value: |
                 certs:
                 - name: hubble-server-certs
                   namespace: kube-system
--- HelmRelease: kube-system/cilium Job: kube-system/hubble-generate-certs-3a9d717bd7

+++ HelmRelease: kube-system/cilium Job: kube-system/hubble-generate-certs-3a9d717bd7

@@ -0,0 +1,67 @@

+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: hubble-generate-certs-3a9d717bd7
+  namespace: kube-system
+  labels:
+    k8s-app: hubble-generate-certs
+    app.kubernetes.io/name: hubble-generate-certs
+    app.kubernetes.io/part-of: cilium
+spec:
+  template:
+    metadata:
+      labels:
+        k8s-app: hubble-generate-certs
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: certgen
+        image: quay.io/cilium/certgen:v0.4.11@sha256:14d29a176fc96d15b154559ce1a5baf01367c10baabfa7bb8028b72f087a56f0
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+        command:
+        - /usr/bin/cilium-certgen
+        args:
+        - --ca-generate=true
+        - --ca-reuse-secret
+        - --ca-secret-namespace=kube-system
+        - --ca-secret-name=cilium-ca
+        - --ca-common-name=Cilium CA
+        - --ca-enforce-validity-throughout-leaves-duration=true
+        env:
+        - name: CILIUM_CERTGEN_CONFIG
+          value: |
+            certs:
+            - name: hubble-server-certs
+              namespace: kube-system
+              commonName: "*.biohazard.hubble-grpc.cilium.io"
+              hosts:
+              - "*.biohazard.hubble-grpc.cilium.io"
+              usage:
+              - signing
+              - key encipherment
+              - server auth
+              - client auth
+              validity: 8760h
+            - name: hubble-relay-client-certs
+              namespace: kube-system
+              commonName: "*.hubble-relay.cilium.io"
+              hosts:
+              - "*.hubble-relay.cilium.io"
+              usage:
+              - signing
+              - key encipherment
+              - client auth
+              validity: 8760h
+      hostNetwork: false
+      serviceAccountName: hubble-generate-certs
+      automountServiceAccountToken: true
+      restartPolicy: OnFailure
+

@tinfoild
tinfoild Bot force-pushed the renovate/cilium branch from 2d4042e to 72f90de Compare August 24, 2026 03:06
@tinfoild tinfoild Bot changed the title feat(helm/cilium): update to v1.20.0 feat(helm/cilium): update to v1.20.1 Aug 24, 2026
@tinfoild tinfoild Bot changed the title feat(helm/cilium): update to v1.20.1 feat(helm/cilium): update to v1.20.2 Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kube/deploy/core renovate/datasource/helm renovate/type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants