What cilium/cilium shipped
Written by FoxPlug from the repository's own releases; not affiliated with Cilium. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/cilium/cilium; Cilium did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- AWS ENI handling now configures each secondary ENI's own IPv6 address on the link, so host-forwarded traffic from secondary ENIs is no longer dropped by the source/destination check. Pull request #48652
- BackendTLSPolicy in the Gateway API now supports system CA certificates for backend validation. Pull request #48895
- Azure IPAM skips network interfaces that the API returns without a MAC address, avoiding empty entries in CiliumNode status that could not be matched to a node link. Pull request #48648
- Dual-stack clusters now get the missing IPv6 health endpoint rules set up. Pull request #49188
- ENABLE_NAT_46X64 became a runtime config variable set at object level when NodePort NAT46/64 translation is enabled. Pull request #49183
- ENABLE_IP_MASQ_AGENT_IPV6 became a node-level runtime config variable enabled when BPF masquerading, IPv6 masquerading and the ip-masq-agent are all on. Pull request #49174
- The DEBUG BPF macro is now a runtime config option. Pull request #49193
- Renaming an ip6tables chain no longer silently drops the ip6tables error during iptables rule reconciliation. Pull request #49024
- Hubble cert-manager certificates no longer duplicate the privateKey block, so user-specified private key algorithm, size and encoding values are honored instead of silently falling back to RSA 2048. Pull request #49114
- The load balancer writer gained a SetFrontendSourceRangesFunc hook to override SourceRanges and allow/deny policy for a service frontend. Pull request #49068
Why it matters
This week brings several fixes that affect real deployments: AWS ENI IPv6 addressing on secondary interfaces, Azure IPAM interfaces still provisioning, and dual-stack health endpoint rules. It also continues converting datapath BPF macros such as DEBUG, ENABLE_NAT_46X64 and ENABLE_IP_MASQ_AGENT_IPV6 into runtime configuration, which makes these behaviors configurable without rebuilding.
Changelog entry
- Aws: configure each ENI's own IPv6 address on the link Pull request #48652
- Azure/ipam: skip interfaces without a MAC address Pull request #48648
- Gateway-api: support system CA certificates in BackendTLSPolicy Pull request #48895
- Dual stack: set up missing health endpoint IPv6 rules Pull request #49188
- Bpf: switch ENABLE_NAT_46X64 to runtime config Pull request #49183
- Bpf: switch ENABLE_IP_MASQ_AGENT_IPV6 to runtime config Pull request #49174
- Bpf: turn DEBUG into runtime config Pull request #49193
- Options: remove unused POLICY_DEBUG macro Pull request #49185
- Iptables: return the ip6tables error when renaming a chain Pull request #49024
- Helm: fix duplicate privateKey in Hubble cert-manager certificates Pull request #49114
- Loadbalancer/writer: add support for SetFrontendSourceRangesFunc Pull request #49068
- Ci: add support for OIDC Pull request #49007
This week: AWS ENIs get their own IPv6 addresses, Azure IPAM skips interfaces without a MAC, dual-stack health endpoint IPv6 rules are set up, and BPF DEBUG, NAT46/64 and IPv6 masquerading-agent settings move to runtime config.
This week Cilium shipped fixes across cloud IPAM and the datapath. On AWS, each secondary ENI now gets its own IPv6 address configured on the link, so host-forwarded traffic from those interfaces is no longer dropped by the source/destination check. Azure IPAM now skips interfaces still provisioning without a MAC address, avoiding unusable entries in CiliumNode status. Dual-stack clusters get the missing IPv6 health endpoint rules. The datapath work continues turning BPF compile-time macros into runtime configuration: DEBUG, ENABLE_NAT_46X64 and ENABLE_IP_MASQ_AGENT_IPV6 are now runtime config variables. Smaller fixes cover ip6tables chain rename errors, Gateway API BackendTLSPolicy system CA certificates, and duplicate privateKey blocks in Hubble cert-manager certificates.
Week of September 28, 2026
What shipped
- Release 1.21.0-pre.3 includes LB IPAM annotation support for sharing IPs between services with externalTrafficPolicy=Local that select different pods. Release
- DROP_NOTIFY converted to runtime config variable, allowing per-endpoint control of drop notifications. Pull request #48956
- BPF code updated to use DSR_ENCAP_MODE instead of ENABLE_DSR in preparation for runtime configuration. Pull request #48981
- Host endpoint drop notifications can now be toggled through the API for endpoints with reserved labels. Pull request #49117
- Fixed mapstate lookup prefix order to correctly determine policy map entries for flow matching. Pull request #49086
- Node-init now waits for the kubelet wrapper to finish before writing the bootstrap file on GKE. Pull request #48739
- On-demand standalone Envoy is now properly stopped during xDS shutdown to prevent socket collisions. Pull request #49118
- Node Address.IP migrated from net.IP to netip for improved type safety. Pull request #48663
- Prometheus container port names are now configurable via Helm values while preserving existing defaults. Pull request #48955
- IP-masq-agent moved to its own cell and removed from the IPAM path after cleanup. Pull request #48949
Why it matters
Release 1.21.0-pre.3 brings important load balancing and configuration improvements. Runtime configuration for drop notifications and DSR mode provides better operational flexibility. Bug fixes in policy matching and node initialization improve reliability in production environments.
Changelog entry
- LB IPAM: introduce lbipam.cilium.io/sharing-permit-different-pods annotation for IP sharing between services Release
- DROP_NOTIFY converted to runtime config for per-endpoint control via cilium-dbg endpoint config Pull request #48956
- Host endpoint drop notifications can now be toggled through the API Pull request #49117
- Fixed mapstate lookup prefix order for correct policy map entry determination Pull request #49086
- Node-init waits for kubelet wrapper completion before bootstrap file write on GKE Pull request #48739
- On-demand Envoy properly stopped during xDS shutdown Pull request #49118
- Node Address.IP migrated from net.IP to netip Pull request #48663
- Prometheus container port names now configurable via Helm Pull request #48955
- BPF updated to use DSR_ENCAP_MODE instead of ENABLE_DSR Pull request #48981
- Fixed typo in hubble --port-forward flag description Pull request #49126
Cilium 1.21.0-pre.3 is out with LB IPAM IP-sharing support, runtime-configurable drop notifications, and fixes for policy matching and node initialization.
Cilium 1.21.0-pre.3 release includes new LB IPAM capabilities for sharing IPs between services, runtime-configurable drop notifications for finer operational control, and important fixes for policy enforcement accuracy and node initialization reliability. These improvements enhance both functionality and operational flexibility for Cilium deployments.
Week of September 21, 2026
What shipped
- Fixed Envoy xDS listener handling bugs that prevented restoration from completing, preserved dynamically allocated proxy ports during address changes, and scoped ADS rollback correctly. Pull request #48897
- Fixed incorrect endpoint manager garbage collection handling that could delete new endpoints when reusing IDs from previously garbage-collected endpoints. Pull request #48905
- Fixed cilium-cli validation to respect --ip-families flag, preventing setup timeouts when validating unreachable IPv6 NodePort addresses on IPv4-only clusters. Pull request #45325
- Reduced Envoy network policy update memory allocations by approximately 40% and overall memory consumption by 10-20%. Pull request #48925
- Fixed UDP connection handling in load balancing to prevent draining terminating backends, which was causing UDP datagrams to be incorrectly routed after backend termination. Pull request #48715
- Migrated IPAMStatus.AssignedStaticIP field and related functions to netip types for better type safety. Pull request #48971
- Moved echo-b connectivity check service from NodePort 31414 to 30014 to avoid conflicts with Kubernetes automatic port allocation. Pull request #48926
- Fixed node neighbor discovery delete queries to use consistent owner ID format, preventing stale forwardable-ip entries from leaking when nodes are deleted. Pull request #48871
- Exposed Hubble Relay startup as reusable building blocks for downstream binaries to construct custom Relay deployments. Pull request #48461
- Optimized FQDN zombie name storage from O(n²) slice-based operations to set-based operations for better performance with large name collections. Pull request #48360
Why it matters
This week includes critical fixes for endpoint management, load balancing edge cases, and network policy performance. Multiple backports ensure stability across recent release branches, while infrastructure improvements address flaky tests and resource constraints in CI.
Changelog entry
- Fixed Envoy xDS listener handling bugs that blocked restoration and lost dynamically allocated proxy ports during address changes Pull request #48897
- Fixed endpoint manager garbage collection race that could delete new endpoints when reusing IDs Pull request #48905
- Fixed cilium-cli to respect --ip-families flag in validation checks Pull request #45325
- Reduced Envoy network policy update memory allocations by ~40% Pull request #48925
- Fixed UDP load balancing to not drain terminating backends Pull request #48715
- Migrated IPAM to use netip.Addr types for better type safety Pull request #48971
- Moved echo-b connectivity check service to avoid NodePort conflicts Pull request #48926
- Fixed node neighbor discovery delete queries to prevent stale entries Pull request #48871
This week: fixed endpoint GC bugs, improved Envoy listener handling, reduced policy update memory by 40%, fixed UDP draining in load balancing, and optimized FQDN operations.
Cilium shipped important fixes this week: corrected endpoint garbage collection to prevent accidental deletion of reused endpoint IDs, fixed Envoy xDS listener restoration and port preservation during address changes, reduced network policy update memory usage by 40%, fixed UDP load balancing to prevent incorrect draining of terminating backends, and optimized FQDN zombie name handling. Multiple stability backports ensure consistency across release branches.
Week of September 14, 2026
What shipped
- Released version 1.20.2 with a fix for AWS IPAM operator trying to release prefix IPs as individual IPs when still in use, and added node label selector support for gateway-api when hostNetwork is enabled. Release
- Released version 1.19.8 with fixes for AWS IPAM prefix delegation on subnets that ran out of prefixes and agent crashes when dumping map events. Release
- Released version 1.18.14 with fixes for AWS IPAM prefix delegation allocation failures and agent crashes when dumping map events. Release
- Fixed unloading DNS policies on shutdown where endpoints would timeout waiting for policy computation that was never requested. Pull request #48747
- Fixed cilium-operator metrics list to support both IPv4 and IPv6 loopback addresses, allowing it to work in IPv6-only mode on dual-stack nodes. Pull request #48780
- Fixed restoration of terminating load-balancing backends on restart to properly distinguish between quarantine states from termination versus health-check failures. Pull request #48763
- Fixed MCS EndpointSlice mirroring to handle service names that exceed 63 characters. Pull request #48783
- Fixed operator to shut down when the controller-runtime manager fails instead of silently continuing. Pull request #48385
- Fixed Envoy policy tier rendering to correctly include port-specific Pass rules when a tier contains a wildcard port rule. Pull request #48854
- Fixed validation of LocalRedirectPolicy to reject policies with empty redirectBackend.toPorts array to prevent agent panic. Pull request #48491
Why it matters
Three patch releases were published addressing AWS IPAM issues affecting production deployments, along with critical fixes for DNS policy handling, operator reliability, and networking edge cases. These fixes improve stability in dual-stack environments and cloud deployments where Cilium is commonly used.
Changelog entry
- Gateway-api: node label selector for when hostNetwork is enabled Release
- Aws/ipam: Fixed operator trying to release prefix IPs as individual IPs when in use Release
- Aws/ipam: Fixed operator failing to allocate IPs on subnets that ran out of prefixes with prefix delegation enabled Release
- Bpf: Fixed agent crash when dumping map events Release
- Daemon: Fixed unloading DNS policies on shutdown to properly request policy computation Pull request #48747
- Operator: Fixed metrics list to try both IPv4 and IPv6 loopback addresses Pull request #48780
- Loadbalancer: Fixed restoration of terminating backends on restart Pull request #48763
- K8s: Fixed MCS EndpointSlice mirroring with service names exceeding 63 characters Pull request #48783
- Operator: Fixed shutdown when controller-runtime manager fails Pull request #48385
- Envoy: Fixed policy tier rendering for port-specific Pass rules Pull request #48854
- K8s: Added validation to reject LocalRedirectPolicy with empty redirectBackend.toPorts Pull request #48491
V1.20.2, v1.19.8, and v1.18.14 released. Fixes for AWS IPAM prefix delegation, DNS policy shutdown, operator crashes, IPv6-only mode support, and Envoy policy tiers.
Cilium releases v1.20.2, v1.19.8, and v1.18.14 now available. Key fixes include: AWS IPAM prefix delegation on exhausted subnets, DNS policy unloading on shutdown, operator reliability improvements, IPv6-only mode support for dual-stack nodes, and Envoy policy tier rendering with port-specific rules. These updates address stability issues in production cloud deployments and improve dual-stack networking support.