v1.18.5: 1.18.5

Compare Source

Summary of Changes

Minor Changes:

• [v1.18] proxy: Bump envoy version to v1.34.11 (#​43143, @​sayboras)
• Change the sidecar etcd instance of the Cluster Mesh API Server listen on all IP addresses (Backport PR #​42948, Upstream PR #​42818, @​giorio94)

Bugfixes:

• allow missing verbs for cilium-agent cluster role when readSecretsOnlyFromSecretsNamespace is false (Backport PR #​42948, Upstream PR #​42790, @​kraashen)
• AWS EC2: Fix ENI attachment on multi-network card instances with high-performance networking (EFA) setups (Backport PR #​42745, Upstream PR #​42512, @​41ks)
• CiliumEnvoyConfig proxy ports are now restored on agent restarts. (Backport PR #​43117, Upstream PR #​43108, @​jrajahalme)
• Cleanup FQDNs that have leaked into the global FQDN cache (Backport PR #​42864, Upstream PR #​42485, @​sjohnsonpal)
• Do not opt-out Endpoint ID 1 from dnsproxy transparent mode. (Backport PR #​42948, Upstream PR #​42887, @​jrajahalme)
• ENI: Fix panic on nil subnet (Backport PR #​43117, Upstream PR #​43023, @​HadrienPatte)
• Ensure cilium-agent gracefully does fallbacks when etcd is in a bad state. (Backport PR #​43059, Upstream PR #​42977, @​odinuge)
• Fix a bug that would cause Cilium to not report L4 checksum update errors when the length attribute is missing in ICMP Error messages with TCP inner packets. (Backport PR #​42828, Upstream PR #​42426, @​yushoyamaguchi)
• Fix a bug that would cause IPsec logs to incorrectly report the XFRM rules being processed as "Ingress" rules. (Backport PR #​42828, Upstream PR #​42640, @​sjohnsonpal)
• Fix agent local identity leak (Backport PR #​43117, Upstream PR #​42662, @​odinuge)
• Fix bug that could cause the agent to fail to add XFRM states when IPsec is enabled, thus preventing a proper startup. (Backport PR #​42948, Upstream PR #​42666, @​pchaigno)
• Fix GC of per-cluster ctmap entries (Backport PR #​43294, Upstream PR #​43160, @​giorio94)
• Fix ipcache issues causing severe issues with the fqdn subsystem (Backport PR #​42864, Upstream PR #​42815, @​odinuge)
• Fix issue where endpoints got stuck in "waiting-to-regenerate" (Backport PR #​42948, Upstream PR #​42856, @​odinuge)
• Fix leak in the policy subsystem (Backport PR #​43117, Upstream PR #​42661, @​odinuge)
• Fix rare kvstore issue where cilium continues to use an expired lease causing kvstore operations to fail consistently (Backport PR #​42745, Upstream PR #​42709, @​odinuge)
• fqdn: Fix fqdn subsystem correctness issues causing packet drops and inconsistent ipcache (Backport PR #​43117, Upstream PR #​42500, @​odinuge)
• In rare cases, the cilium-operator losing the lead of the HA deployment could continue acting as if leading for at most a minute, leading to split-brain problems such as double allocation of pod CIDRs. (Backport PR #​43059, Upstream PR #​42920, @​bimmlerd)
• KVStoreMesh now correctly respects the CA bundle setting when validating remote cluster certificates (Backport PR #​42828, Upstream PR #​42726, @​giorio94)
• policy: Fix rare Endpoint Selector Policy Deadlock causing policies to not be updated with new identities (Backport PR #​42864, Upstream PR #​42306, @​odinuge)
• Recreate CiliumEndpoints (k8s resource) if they are accidentally deleted. (Backport PR #​43117, Upstream PR #​42877, @​aanm)
• redirectpolicy: Avoid recomputing on pod changes that do not change resulting redirect backends (Backport PR #​42948, Upstream PR #​42814, @​joamaki)

CI Changes:

• bpf: test: add BPF Masq tests for unknown / handled protocols (Backport PR #​42711, Upstream PR #​42144, @​julianwiedmann)
• bpf: test: egressgw: fix up ENABLE_MASQUERADE (Backport PR #​42966, Upstream PR #​42912, @​julianwiedmann)
• bpf: tests: add BPF MASQ test for ICMP ECHOs (Backport PR #​42711, Upstream PR #​42656, @​julianwiedmann)
• bpf: tests: set ENABLE_MASQUERADE_IPV6 for EGW XDP test (Backport PR #​43059, Upstream PR #​42962, @​julianwiedmann)
• bpf:test: cover host endpoint case in tc_nodeport_l3_dev.h (Backport PR #​43059, Upstream PR #​42983, @​smagnani96)
• Delete .github/workflows/build-images-hotfixes.yaml (Backport PR #​42966, Upstream PR #​42958, @​sekhar-isovalent)
• gh: conn-disrupt: fix XFRM error checks (Backport PR #​42764, Upstream PR #​42724, @​julianwiedmann)
• gh: ipsec-e2e: fix flaky connection disruptivity test (Backport PR #​42823, Upstream PR #​42780, @​julianwiedmann)
• gha: additionally cleanup disk space in clustermesh upgrade workflow (Backport PR #​42948, Upstream PR #​42862, @​giorio94)
• gha: don't filter lint-build-commits steps when workflow is modified (Backport PR #​42948, Upstream PR #​42844, @​giorio94)
• gha: wait for cert-manager CRDs to be ready in conformance clustermesh (Backport PR #​42966, Upstream PR #​42947, @​giorio94)
• makefile: More reliable update-helm-values (Backport PR #​42828, Upstream PR #​42736, @​devodev)

Misc Changes:

• .github/workflows: make adjustments for new GitHub workflow behavior (#​43219, @​aanm)
• [v1.18] deps: bump x/crypto to v0.45.0 (#​43114, @​ferozsalam)
• [v1.18] vendor: Bump to StateDB v0.4.6 (#​42953, @​joamaki)
• chore(deps): update all github action dependencies (v1.18) (#​42783, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​42937, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43036, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43181, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43268, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43317, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (patch) (#​43314, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​42804, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​43037, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.18.9 (v1.18) (#​43182, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.28 (v1.18) (#​42771, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33.1 (v1.18) (#​42805, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33.2 (v1.18) (#​43184, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.11 (v1.18) (#​43315, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to d80cd69 (v1.18) (#​43312, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.10 docker digest to 7b13449 (v1.18) (#​42935, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.10 docker digest to 83d7392 (v1.18) (#​42802, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.11 docker digest to e3fb71a (v1.18) (#​43313, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to 2b7c93f (v1.18) (#​43135, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.6 (v1.18) (#​42936, @​cilium-renovate[bot])
• chore(deps): update github artifact actions (v1.18) (#​43318, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.11 (v1.18) (#​43183, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.3.1 (v1.18) (#​43052, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​42803, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43316, @​cilium-renovate[bot])
• docs: Add limitation about LB to same backend via multiple VIPs (Backport PR #​42745, Upstream PR #​42632, @​brb)
• Documentation: host firewall: document emergency recovery (Backport PR #​42948, Upstream PR #​42776, @​squeed)
• fqdn: rewrite name manager test to use real ipcache (Backport PR #​42948, Upstream PR #​42820, @​odinuge)
• Minor improvements around certificate validation in etcd/clustermesh troubleshoot commands (Backport PR #​42948, Upstream PR #​42782, @​giorio94)
• node/manager: TestNodesStartupPruning poll state (Backport PR #​42948, Upstream PR #​41648, @​0xch4z)
• policy: Marshal L4Filter marshalling errors into json (Backport PR #​42948, Upstream PR #​42834, @​joestringer)
• xds: Do not log an error on a done context (Backport PR #​43117, Upstream PR #​42990, @​jrajahalme)

Other Changes:

• [v1.18] Add periodic resync for secret-sync controller (#​43356, @​youngnick)
• [v1.18] bpf: lxc: transfer source identity for lxc-to-host policy (#​42821, @​julianwiedmann)
• [v1.18] ipcache: Fix leak in CIDR metadata consolidation logic (#​43354, @​christarazi)
• [v1.18] lb: Implement Hybrid-DSR via annotation infrastructure (#​43056, @​julianwiedmann)
• [v1.18] proxy: Bump envoy version to v1.34.12 (#​43259, @​sayboras)
• install: Update image digests for v1.18.4 (#​42735, @​cilium-release-bot[bot])
• Kubernetes endpoints that are terminating are retained in the backends BPF state regardless of the "serving" condition to avoid connection disruptions when a pod no longer signals readiness to process new connections. (#​42708, @​joamaki)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.5@​sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
quay.io/cilium/cilium:stable@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.5@​sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1
quay.io/cilium/clustermesh-apiserver:stable@sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1

docker-plugin

quay.io/cilium/docker-plugin:v1.18.5@​sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f
quay.io/cilium/docker-plugin:stable@sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.5@​sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446
quay.io/cilium/hubble-relay:stable@sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.5@​sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c
quay.io/cilium/operator-alibabacloud:stable@sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c

operator-aws

quay.io/cilium/operator-aws:v1.18.5@​sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52
quay.io/cilium/operator-aws:stable@sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52

operator-azure

quay.io/cilium/operator-azure:v1.18.5@​sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6
quay.io/cilium/operator-azure:stable@sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6

operator-generic

quay.io/cilium/operator-generic:v1.18.5@​sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99
quay.io/cilium/operator-generic:stable@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99

operator

quay.io/cilium/operator:v1.18.5@​sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606
quay.io/cilium/operator:stable@sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606

v3.19.4: Helm v3.19.4

Compare Source

Helm v3.19.4 is a security fix for a Go CVE in the previous tag. This patch release rebuilds the Helm v3.19.3 release with the latest Go toolchain, to fix the Go CVE. Users are encouraged to upgrade.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• [v3 backport] fix: Use latest patch release of Go in releases #​31637

Installation and Upgrading

Download Helm v3.19.4. The common platform binaries are here:

• MacOS amd64 (checksum / d9c9b1fc499c54282c4127c60cdd506da2c6202506b708a2b45fb6dfdb318f43)
• MacOS arm64 (checksum / 7e82ca63fe80a298cecefad61d0c10bc47963ff3551e94ab6470be6393a6a74b)
• Linux amd64 (checksum / 759c656fbd9c11e6a47784ecbeac6ad1eb16a9e76d202e51163ab78504848862)
• Linux arm (checksum / fcbb21b657c46ad646542964c262c4efb595bc60621e34273c1a2bb92eaff1dc)
• Linux arm64 (checksum / 9e1064f5de43745bdedbff2722a1674d0397bc4b4d8d8196d52a2b730909fe62)
• Linux i386 (checksum / 5bbf5541cb021c021a7f5b3e59e3808cc09678aa2650ece24c78f8a277466c0b)
• Linux ppc64le (checksum / a38d8f75406f9bc3e12d1ebf8819fd563a5156ada6fe665402732932eec9c743)
• Linux s390x (checksum / d153b3a316ce3f2936e601d94db5909aae4fbd5d1a4b28760fad2dd18c2bb749)
• Linux riscv64 (checksum / 9d90a7532b426e5d99edfa9fa93e1dba4729f96a3b493974e847651a9aa34020)
• Windows amd64 (checksum / 18e7d1b970dfb6f4f8ddbbd1659d75d90ca818a47519411c4cc305b918508d36)
• Windows arm64 (checksum / da870dbb870e5cad243f5c7dca54f27be289237a97d84077c885769a06394223)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 3.19.5 and 4.0.4 are the next patch releases and will be on January 14, 2026
• 3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026

Changelog

• Use latest patch release of Go in releases 7cfb6e4 (Matt Farina)
• chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 59c951f (dependabot[bot])
• chore(deps): bump github.com/cyphar/filepath-securejoin d45f3f1 (dependabot[bot])
• chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 d459544 (dependabot[bot])
• chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 becd387 (dependabot[bot])
• chore(deps): bump the k8s-io group with 7 updates edb1579 (dependabot[bot])

v3.19.3

Compare Source