fix(container): update image quay.io/cilium/charts/cilium ( 1.19.5 → 1.19.6 ) - #5957
Merged
Conversation
Contributor
--- ConfigMap kube-system/cilium-config
+++ ConfigMap kube-system/cilium-config
@@ -59,6 +59,7 @@
enable-health-check-loadbalancer-ip: "false"
enable-health-check-nodeport: "true"
enable-health-checking: "true"
+ enable-host-firewall: "false"
enable-hubble: "false"
enable-ipv4: "true"
enable-ipv4-big-tcp: "true"
--- DaemonSet kube-system/cilium
+++ DaemonSet kube-system/cilium
@@ -16,7 +16,7 @@
template:
metadata:
annotations:
- cilium.io/cilium-configmap-checksum: 4e689eba7c6ffca2a7b9b207378f33b3a1ec716ddd5e834d5cadfecfb9c7f51e
+ cilium.io/cilium-configmap-checksum: 84964aa0d0ff0a7b45fdf64396409faf3a24727f4770e806c0afdcb3c7f7174e
kubectl.kubernetes.io/default-container: cilium-agent
labels:
app.kubernetes.io/name: cilium-agent
@@ -62,7 +62,7 @@
value: "1"
- name: KUBE_CLIENT_BACKOFF_DURATION
value: "120"
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
lifecycle:
postStart:
@@ -224,7 +224,7 @@
value: 127.0.0.1
- name: KUBERNETES_SERVICE_PORT
value: "7445"
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
name: config
securityContext:
@@ -249,7 +249,7 @@
value: /sys/fs/cgroup
- name: BIN_PATH
value: /opt/cni/bin
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
name: mount-cgroup
securityContext:
@@ -279,7 +279,7 @@
env:
- name: BIN_PATH
value: /opt/cni/bin
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
name: apply-sysctl-overwrites
securityContext:
@@ -305,7 +305,7 @@
- /bin/bash
- -c
- --
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
name: mount-bpf-fs
securityContext:
@@ -340,7 +340,7 @@
value: 127.0.0.1
- name: KUBERNETES_SERVICE_PORT
value: "7445"
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
name: clean-cilium-state
securityContext:
@@ -367,7 +367,7 @@
name: cilium-run
- command:
- /install-plugin.sh
- image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
name: install-cni-binaries
resources:
--- Deployment kube-system/cilium-operator
+++ Deployment kube-system/cilium-operator
@@ -24,7 +24,7 @@
template:
metadata:
annotations:
- cilium.io/cilium-configmap-checksum: 4e689eba7c6ffca2a7b9b207378f33b3a1ec716ddd5e834d5cadfecfb9c7f51e
+ cilium.io/cilium-configmap-checksum: 84964aa0d0ff0a7b45fdf64396409faf3a24727f4770e806c0afdcb3c7f7174e
labels:
app.kubernetes.io/name: cilium-operator
app.kubernetes.io/part-of: cilium
@@ -66,7 +66,7 @@
value: 127.0.0.1
- name: KUBERNETES_SERVICE_PORT
value: "7445"
- image: quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4
+ image: quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
--- OCIRepository kube-system/cilium
+++ OCIRepository kube-system/cilium
@@ -12,6 +12,6 @@
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
- tag: 1.19.5
+ tag: 1.19.6
url: oci://quay.io/cilium/charts/cilium
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
cilium (kube-system, high-blast-radius: networking): 1.19.5 → 1.19.6
Verdict: Safe to merge
Patch release, 123 upstream commits. Reviewed the full commit log between 1.19.5 and 1.19.6 (Renovate's embedded release notes were just a compare link, no body).
Security fix (bundled, not exploitable in this config):
- GHSA-33qq-jq9c-6gcc — critical mutual-auth (mTLS) bypass via certificate substitution in
verifyPeerCertificate. Only reachable when Cilium's mutual authentication (SPIRE-based) feature is enabled. This repo'skubernetes/kube-system/cilium/cilium.yamlHelmRelease values have noauthenticationblock configured, so mTLS is not in use — not exploitable here, but a good reason to take the upgrade regardless.
Notable fix that self-reverted within this same release (net no-op):
- Three commits ("preserve restored policy map entries during regeneration", its "reap" follow-up, and "sync desired policy before reload on the restore path") addressed a POLICY_DENIED connection-drop bug on cross-version datapath restarts/downgrades — directly relevant since this repo runs
bpf.datapathMode: netkit. However, all three were reverted later in the same 1.19.6 commit range once an unrelated policy-map rename (cilium_policy_v3_, upstream #47080-related) made the original scenario impossible. Net effect on 1.19.6 vs 1.19.5 behavior: none. Flagging only so this isn't mistaken for a shipped fix.
Not applicable to this repo:
- Gateway API multi-port HTTPS/TLS-passthrough listener fixes —
gatewayAPI.enabled: falsein values. - Hubble correlation/export fixes —
hubble.enabled: false. - kvstore/etcd circuit-breaker and double-write panic fixes —
ipam.mode: kubernetes, no kvstore backend configured. - Envoy L7 policy propagation fix —
envoy.enabled: false. - BIG TCP UDP-tunnel-check fix — only affects
routingMode: tunnel; this repo usesroutingMode: native.
Possibly relevant, low-risk:
loadbalancer: decouple and simplify DSR dispatch configuration validation— repo usesloadBalancer.mode: dsr. Purely relaxes an overly-restrictive validation (allowsopt/ipip/genevefor LB-annotation-mode DSR instead of IPIP-only); not a behavior change for the existing native-routing DSR config.- Two BGP status-condition "Reason" fixes in the BGP operator/manager — repo has
bgpControlPlane.enabled: trueand aCiliumBGP*config inbgp.yaml. Cosmetic (conditionReasonstring accuracy only), no functional/API change. - Operator fixes for
cilium_operator_unmanaged_podsgauge accuracy and a nil-pointer panic in CiliumNode GC — repo runsoperator.replicas: 2; both are stability improvements with no config changes required.
Known issues: Searched cilium/cilium open issues for v1.19.6 regression reports — none found.
Sources consulted:
- https://redirect.github.com/cilium/cilium/compare/1.19.5...1.19.6 (full commit log, 123 commits)
- https://redirect.github.com/cilium/cilium/security/advisories/GHSA-33qq-jq9c-6gcc
kubernetes/kube-system/cilium/cilium.yaml,kubernetes/kube-system/cilium/bgp.yaml,setup/bootstrap/helmfile.d/01-apps.yamlin this repo- GitHub search: open issues in
cilium/ciliummentioningv1.19.6(none found)
Claude Review Usage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.19.5→1.19.6Release Notes
cilium/cilium (quay.io/cilium/charts/cilium)
v1.19.6: 1.19.6Compare Source
Summary of Changes
Minor Changes:
spec.telemetry.accessLogsfield in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev)Bugfixes:
cilium_operator_unmanaged_podsgauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #46975, Upstream PR #46668, @Suyash1700)service.cilium.io/affinity: "none"incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #46691, Upstream PR #46635, @mkamadeus)CI Changes:
Misc Changes:
00feed3(v1.19) (#46657, @cilium-renovate[bot])be93311(v1.19) (#46907, @cilium-renovate[bot])cf1189d(v1.19) (#47115, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.6@​sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.6@​sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6docker-plugin
quay.io/cilium/docker-plugin:v1.19.6@​sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9echubble-relay
quay.io/cilium/hubble-relay:v1.19.6@​sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.6@​sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efafoperator-aws
quay.io/cilium/operator-aws:v1.19.6@​sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3operator-azure
quay.io/cilium/operator-azure:v1.19.6@​sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adeddoperator-generic
quay.io/cilium/operator-generic:v1.19.6@​sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665operator
quay.io/cilium/operator:v1.19.6@​sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.