Shipped · Observability

What cilium/cilium shipped

The public repository of Cilium · github.com/cilium/cilium

Written by FoxPlug from the repository's own releases; not affiliated with Cilium. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/cilium/cilium; Cilium did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for cilium, free

Week of November 2, 2026

What shipped

Why it matters

This week brings several datapath changes that affect how traffic is handled: the IPsec internal IP option works again, BPF masquerade with kube-proxy can reverse DNAT for hairpin traffic, and ENABLE_NODEPORT is back as runtime config after a revert. Operators also get per-pool IPAM metrics and new clustermesh EndpointSlice sync logic, while the RX queue work continues toward steering Pod traffic to reserved hardware queues.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: the IPsec internal IP flag works again after passing the real config to the node handler, the ENABLE_NODEPORT runtime config work was reapplied, and a hairpin SNAT rule fixes eTP=Local and NodePort reachability with BPF masquerade and kube-proxy. Also: per-pool IPAM me

Post for LinkedIn

A busy week in the Cilium datapath and control plane. NewNodeHandler was passing a zero-value fake IPsec config, so --use-cilium-internal-ip-for-ipsec was silently ignored; it now gets the real config, and the fix is backported to v1.19 and v1.20. The ENABLE_NODEPORT runtime config change was reapplied with optimizations, and an iptables hairpin SNAT rule lets pods reach eTP=Local LB VIPs and NodePorts on their own node when using BPF masquerade with kube-proxy. Elsewhere, multi-pool IPAM gained per-pool IP and CIDR-block metrics, clustermesh gained an EndpointSliceSync controller for ClusterEndpointSlice, and RX queue work now lets a Pod lease its reserved queue on eth0 as a second receive queue.

Week of October 26, 2026

What shipped

Why it matters

This week's changes touch datapath startup cost, policy correctness and several connectivity features. Restarting the agent can now skip repeated BPF compilation, policy computation handles concurrent identity removal more carefully, and DNS proxy rules follow identity changes. BGP unnumbered peering and runtime host firewall configuration also expand what operators can enable without rebuilding.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: agent reuses compiled BPF objects across restarts, BGP unnumbered peering lands, policy computation drops results for identities removed mid-run, CIDR identity range aligned with MaxLocalIdentity, and DNS redirects refresh after identity changes.

Post for LinkedIn

This week in Cilium: the agent now reuses compiled endpoint templates and base BPF programs across restarts when build and configuration are unchanged, avoiding recompilation on every start. BGP unnumbered peering (RFC 5549) is supported. Policy computation drops results for identities removed mid-computation and avoids leaking superseded policies. CIDR identity range is aligned with MaxLocalIdentity, DNS redirect rules refresh after identity changes, and IPsec key loading reports clearer format errors. ENABLE_HOST_FIREWALL is now runtime configurable, and a new operator flag empties CiliumEndpointSlices before deletion.

Week of October 19, 2026

What shipped

Why it matters

This week includes out-of-band security patch releases for 1.20, 1.19 and 1.18 that remove trust in compromised intermediate CA certificates, so users should plan upgrades. Several fixes address correctness in IPAM, endpoint policy, cloud resync and Gateway API behavior. BPF masquerading is enabled by default again, and routing configuration moves to runtime config, both of which change upgrade behavior.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Security patch releases 1.20.4, 1.19.10 and 1.18.16 are out with Go 1.26.10 to stop trusting compromised eMudhra intermediates. Also this week: BPF masquerading enabled by default, multi-pool IPAM ordering fixed, and Gateway API listener TLS min/max options added.

Post for LinkedIn

Out-of-band security patch releases 1.20.4, 1.19.10 and 1.18.16 are available. They upgrade Go to 1.26.10 so compromised eMudhra intermediate CA certificates are no longer trusted, and update dependencies to their latest patch versions. Other changes this week: BPF masquerading is enabled by default after the earlier attempt was reverted; multi-pool IPAM release now preserves allocator ordering; the operator no longer expands delegated prefixes into ENI addresses; full cloud resyncs no longer overwrite cache updates; the ENABLE_ROUTING macro became runtime config enable_bpf_routing; and Gateway API listeners gain TLS min and max version options.

Week of October 12, 2026

What shipped

Why it matters

This week brings several behavior fixes that people running Cilium will notice: masquerade handling for node InternalIP addresses changed, wildcard CIDR policies work with node match mode, and terminating backends stay selected under topology-aware routing. Gateway API client certificate validation and multi pool resource IPAM in the agent add new capability. Three stable patch releases also shipped bugfixes for conntrack garbage collection and endpoint restore.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: node InternalIP masquerade behavior changed, wildcard CIDR policy fixed for node match mode, terminating backends stay selected under topology-aware routing, and Gateway API client certificate validation landed. Patch releases 1.20.3, 1.19.9 and 1.18.15 shipped.

Post for LinkedIn

This week in Cilium: traffic to node InternalIP addresses is no longer always masqueraded when enable-remote-node-masquerade is set, wildcard CIDR NetworkPolicy selectors now match correctly with policy-cidr-match-mode set to nodes, and terminating backends stay selected during pod grace periods under topology-aware routing. Engineering work continued on IPAM: the ENI operator no longer sizes IPv4 pools for nodes with IPv4 disabled, and the agent gained support for Multi Pool Resource IPAM through the network driver, with the CiliumResourceIPPool CRD now installed automatically. Gateway API client certificate validation per GEP-91 was implemented. Patch releases 1.20.3, 1.19.9 and 1.18.15 shipped.

Week of October 5, 2026

What shipped

Why it matters

This week brings several fixes that affect real deployments: AWS ENI IPv6 addressing on secondary interfaces, Azure IPAM interfaces still provisioning, and dual-stack health endpoint rules. It also continues converting datapath BPF macros such as DEBUG, ENABLE_NAT_46X64 and ENABLE_IP_MASQ_AGENT_IPV6 into runtime configuration, which makes these behaviors configurable without rebuilding.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: AWS ENIs get their own IPv6 addresses, Azure IPAM skips interfaces without a MAC, dual-stack health endpoint IPv6 rules are set up, and BPF DEBUG, NAT46/64 and IPv6 masquerading-agent settings move to runtime config.

Post for LinkedIn

This week Cilium shipped fixes across cloud IPAM and the datapath. On AWS, each secondary ENI now gets its own IPv6 address configured on the link, so host-forwarded traffic from those interfaces is no longer dropped by the source/destination check. Azure IPAM now skips interfaces still provisioning without a MAC address, avoiding unusable entries in CiliumNode status. Dual-stack clusters get the missing IPv6 health endpoint rules. The datapath work continues turning BPF compile-time macros into runtime configuration: DEBUG, ENABLE_NAT_46X64 and ENABLE_IP_MASQ_AGENT_IPV6 are now runtime config variables. Smaller fixes cover ip6tables chain rename errors, Gateway API BackendTLSPolicy system CA certificates, and duplicate privateKey blocks in Hubble cert-manager certificates.

Week of September 28, 2026

What shipped

Why it matters

Release 1.21.0-pre.3 brings important load balancing and configuration improvements. Runtime configuration for drop notifications and DSR mode provides better operational flexibility. Bug fixes in policy matching and node initialization improve reliability in production environments.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Cilium 1.21.0-pre.3 is out with LB IPAM IP-sharing support, runtime-configurable drop notifications, and fixes for policy matching and node initialization.

Post for LinkedIn

Cilium 1.21.0-pre.3 release includes new LB IPAM capabilities for sharing IPs between services, runtime-configurable drop notifications for finer operational control, and important fixes for policy enforcement accuracy and node initialization reliability. These improvements enhance both functionality and operational flexibility for Cilium deployments.

Week of September 21, 2026

What shipped

Why it matters

This week includes critical fixes for endpoint management, load balancing edge cases, and network policy performance. Multiple backports ensure stability across recent release branches, while infrastructure improvements address flaky tests and resource constraints in CI.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: fixed endpoint GC bugs, improved Envoy listener handling, reduced policy update memory by 40%, fixed UDP draining in load balancing, and optimized FQDN operations.

Post for LinkedIn

Cilium shipped important fixes this week: corrected endpoint garbage collection to prevent accidental deletion of reused endpoint IDs, fixed Envoy xDS listener restoration and port preservation during address changes, reduced network policy update memory usage by 40%, fixed UDP load balancing to prevent incorrect draining of terminating backends, and optimized FQDN zombie name handling. Multiple stability backports ensure consistency across release branches.

Week of September 14, 2026

What shipped

Why it matters

Three patch releases were published addressing AWS IPAM issues affecting production deployments, along with critical fixes for DNS policy handling, operator reliability, and networking edge cases. These fixes improve stability in dual-stack environments and cloud deployments where Cilium is commonly used.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.20.2, v1.19.8, and v1.18.14 released. Fixes for AWS IPAM prefix delegation, DNS policy shutdown, operator crashes, IPv6-only mode support, and Envoy policy tiers.

Post for LinkedIn

Cilium releases v1.20.2, v1.19.8, and v1.18.14 now available. Key fixes include: AWS IPAM prefix delegation on exhausted subnets, DNS policy unloading on shutdown, operator reliability improvements, IPv6-only mode support for dual-stack nodes, and Envoy policy tier rendering with port-specific rules. These updates address stability issues in production cloud deployments and improve dual-stack networking support.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-11-09.

Is this your repo? Ask us to remove this page.