Skip to content

Comments

fix(container): update image ghcr.io/home-operations/charts-mirror/cilium ( 1.18.1 ➔ 1.18.2 )#3359

Merged
binaryn3xus merged 2 commits intomainfrom
renovate/ghcr.io-home-operations-charts-mirror-cilium-1.x
Sep 19, 2025
Merged

fix(container): update image ghcr.io/home-operations/charts-mirror/cilium ( 1.18.1 ➔ 1.18.2 )#3359
binaryn3xus merged 2 commits intomainfrom
renovate/ghcr.io-home-operations-charts-mirror-cilium-1.x

Conversation

@unsc-oni-ancilla
Copy link
Contributor

This PR contains the following updates:

Package Update Change
ghcr.io/home-operations/charts-mirror/cilium (source) patch 1.18.1 -> 1.18.2

Release Notes

cilium/cilium (ghcr.io/home-operations/charts-mirror/cilium)

v1.18.2: 1.18.2

Compare Source

Summary of Changes

Minor Changes:

  • Fix validation bug where namespaced CiliumNetworkPolicies with nodeSelector in specs array were silently accepted but ignored. Now properly rejected with validation error. (Backport PR #​41365, Upstream PR #​40702, @​pillai-ashwin)
  • lbipam: do not reallocate IPs in LB IPAM on operator restart (Backport PR #​41267, Upstream PR #​41147, @​marseel)
  • lbipam: widening CIDR range or updating selector of CiliumLoadBalancerIPPool does no longer reassign IPs (Backport PR #​41267, Upstream PR #​41122, @​marseel)

Bugfixes:

  • Add option to configure BGP origin attribute for LoadBalancer IPs in BGP Control Plane v2, allowing smoother migration from MetalLB integration. (Backport PR #​41479, Upstream PR #​41231, @​hanapedia)
  • Add toleration for 'node.cloudprovider.kubernetes.io/uninitialized' to Cilium Operator (Backport PR #​41267, Upstream PR #​41098, @​guettli)
  • bgpv2: Avoid modifying CiliumBGPPeerConfig in resource store (Backport PR #​41267, Upstream PR #​41088, @​rastislavs)
  • bpf: add support for delinearized ARP packets (Backport PR #​41365, Upstream PR #​41233, @​vsinitsyn)
  • ctmap/gc: continue interval time on partial GC pass. (Backport PR #​41591, Upstream PR #​41258, @​tommyp1ckles)
  • Disable unnecessary headless service watching to reduce API server load in clusters not using the Gateway API or Ingress features. (Backport PR #​41479, Upstream PR #​40844, @​moscicky)
  • Fix "Error while correcting L4 checksum" dropped packets for ICMP destination unreachable error packets. (Backport PR #​41591, Upstream PR #​40194, @​br4243)
  • Fix "No mapping for NAT masquerade" flakes in the CI, make NAT LRU fallbacks more robust. (Backport PR #​41365, Upstream PR #​40971, @​gentoo-root)
  • Fix --exclude-local-address with eBPF Host-Routing (Backport PR #​41365, Upstream PR #​41275, @​antonipp)
  • Fix a BGP bug where the routerID specified in a CiliumBGPNodeConfigOverride was not correctly updated in RouterIDIPPool mode. (Backport PR #​41267, Upstream PR #​40340, @​liyihuang)
  • Fix a bug that would cause NodePort requests to be sent to the wrong backends when using KPR and Clustermesh with two identical, non-global NodePort services on different clusters. (Backport PR #​41591, Upstream PR #​41337, @​pchaigno)
  • Fix a bug where cilium-agent would report "Link not found" for an endpoint deleted during state restore after cilium-agent restart. (Backport PR #​41267, Upstream PR #​40568, @​fristonio)
  • Fix a regression where enabling unknown Hubble metrics would crash the cilium agent (Backport PR #​41479, Upstream PR #​41368, @​devodev)
  • Fix agent config initContainer unable to hit apiservers in apiServerURLs by passing as container arg (Backport PR #​41267, Upstream PR #​41110, @​JJGadgets)
  • Fix bug that would cause error messages when disabling agent health checks (Backport PR #​41479, Upstream PR #​41297, @​HadrienPatte)
  • Fix issue in Local Redirect Policies where traffic was dropped when no local pods were available to be redirected to. In these scenarios the traffic should have been processed as if the Local Redirect Policy did not exist. (Backport PR #​41591, Upstream PR #​41463, @​joamaki)
  • Fix issue where Local Redirect Policy (LRP) services with a single named port did not create a local redirect service entry. (Backport PR #​41591, Upstream PR #​41534, @​aditighag)
  • Fix the bug local redirect policy not doing filter based destination port (Backport PR #​41479, Upstream PR #​41411, @​liyihuang)
  • Fixes a cosmetic bug where the cilium_bpf_map_ops_total error count was incorrectly being incremented for map cilium_lb_affinity_match. (Backport PR #​41479, Upstream PR #​41378, @​squeed)
  • Fixes an issue in NodeManager where restored cluster nodes can be pruned before the initial node listing completes. (Backport PR #​41267, Upstream PR #​41039, @​0xch4z)
  • Helm: Ensure consistent default labels for all ServiceMonitor resources (Backport PR #​41267, Upstream PR #​41240, @​baurmatt)
  • iptables: Fix IPv6 SNAT for L7 proxy upstream traffic (Backport PR #​41249, Upstream PR #​41034, @​gentoo-root)
  • loadbalancer/writer: add support for SetIsServiceHealthCheckedFunc (Backport PR #​41267, Upstream PR #​41092, @​mhofstetter)
  • neighbor: Fix bug where neighbor discovery subsystem reports unhealthy when it is healthy (Backport PR #​41365, Upstream PR #​41186, @​mhofstetter)
  • pkg/ipam: fix nil dereference during pool shrink operation (Backport PR #​41365, Upstream PR #​41198, @​alimehrabikoshki)
  • policy: fix agent crash due to policy cache update-delete race (Backport PR #​41267, Upstream PR #​41079, @​fristonio)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.2@​sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
quay.io/cilium/cilium:stable@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.2@​sha256:cd689a07bfc7622e812fef023cb277fdc695b60a960d36f32f93614177a7a0f6
quay.io/cilium/clustermesh-apiserver:stable@sha256:cd689a07bfc7622e812fef023cb277fdc695b60a960d36f32f93614177a7a0f6

docker-plugin

quay.io/cilium/docker-plugin:v1.18.2@​sha256:be578aaae7274ef7155bd0a6d2f7c2d91085642aea4fdb24451ee9cab4ca2e5d
quay.io/cilium/docker-plugin:stable@sha256:be578aaae7274ef7155bd0a6d2f7c2d91085642aea4fdb24451ee9cab4ca2e5d

hubble-relay

quay.io/cilium/hubble-relay:v1.18.2@​sha256:6079308ee15e44dff476fb522612732f7c5c4407a1017bc3470916242b0405ac
quay.io/cilium/hubble-relay:stable@sha256:6079308ee15e44dff476fb522612732f7c5c4407a1017bc3470916242b0405ac

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.2@​sha256:612b1d94c179cd8ae239e571e96ebd95662bb5cccb62aacfdf79355aa9cdddc8
quay.io/cilium/operator-alibabacloud:stable@sha256:612b1d94c179cd8ae239e571e96ebd95662bb5cccb62aacfdf79355aa9cdddc8

operator-aws

quay.io/cilium/operator-aws:v1.18.2@​sha256:1cb856fbe265dfbcfe816bd6aa4acaf006ecbb22dcc989116a1a81bb269ea328
quay.io/cilium/operator-aws:stable@sha256:1cb856fbe265dfbcfe816bd6aa4acaf006ecbb22dcc989116a1a81bb269ea328

operator-azure

quay.io/cilium/operator-azure:v1.18.2@​sha256:9696e9b8219b9a5c16987e072eda2da378d42a32f9305375e56d7380a0c2ba8e
quay.io/cilium/operator-azure:stable@sha256:9696e9b8219b9a5c16987e072eda2da378d42a32f9305375e56d7380a0c2ba8e

operator-generic

quay.io/cilium/operator-generic:v1.18.2@​sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805
quay.io/cilium/operator-generic:stable@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805

operator

quay.io/cilium/operator:v1.18.2@​sha256:0f234ce2ab0f30c09f4f9fe1b9c6323f0c6b66d789bef5e958fce7cff85960f3
quay.io/cilium/operator:stable@sha256:0f234ce2ab0f30c09f4f9fe1b9c6323f0c6b66d789bef5e958fce7cff85960f3


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@unsc-oni-ancilla unsc-oni-ancilla bot added renovate/container type/patch area/kubernetes Changes made in the kubernetes directory labels Sep 17, 2025
@unsc-oni-ancilla
Copy link
Contributor Author

--- kubernetes/apps/kube-system/cilium/app Kustomization: kube-system/cilium OCIRepository: kube-system/cilium

+++ kubernetes/apps/kube-system/cilium/app Kustomization: kube-system/cilium OCIRepository: kube-system/cilium

@@ -11,9 +11,9 @@

 spec:
   interval: 5m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 1.18.1
+    tag: 1.18.2
   url: oci://ghcr.io/home-operations/charts-mirror/cilium
 

@unsc-oni-ancilla
Copy link
Contributor Author

--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

@@ -121,12 +121,13 @@

   enable-l2-announcements: 'true'
   enable-bgp-control-plane: 'true'
   bgp-secrets-namespace: kube-system
   enable-bgp-control-plane-status-report: 'true'
   bgp-router-id-allocation-mode: default
   bgp-router-id-allocation-ip-pool: ''
+  enable-bgp-legacy-origin-attribute: 'false'
   procfs: /host/proc
   bpf-root: /sys/fs/bpf
   cgroup-root: /sys/fs/cgroup
   identity-management-mode: agent
   enable-sctp: 'false'
   remove-cilium-node-taints: 'true'
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -16,13 +16,13 @@

     rollingUpdate:
       maxUnavailable: 2
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 4970d082f3251a10419e80b2a774fed7ea03f295fdf9746d92cf6d429d29e822
+        cilium.io/cilium-configmap-checksum: 427e188f36140497951fb3654ae066f7eda242999d77ad3282151a69fd109bda
         kubectl.kubernetes.io/default-container: cilium-agent
       labels:
         k8s-app: cilium
         app.kubernetes.io/name: cilium-agent
         app.kubernetes.io/part-of: cilium
     spec:
@@ -30,13 +30,13 @@

         appArmorProfile:
           type: Unconfined
         seccompProfile:
           type: Unconfined
       containers:
       - name: cilium-agent
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         command:
         - cilium-agent
         args:
         - --config-dir=/tmp/cilium/config-map
         startupProbe:
@@ -196,13 +196,13 @@

         - name: xtables-lock
           mountPath: /run/xtables.lock
         - name: tmp
           mountPath: /tmp
       initContainers:
       - name: config
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         command:
         - cilium-dbg
         - build-config
         env:
         - name: K8S_NODE_NAME
@@ -221,13 +221,13 @@

           value: '7445'
         volumeMounts:
         - name: tmp
           mountPath: /tmp
         terminationMessagePolicy: FallbackToLogsOnError
       - name: mount-cgroup
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         env:
         - name: CGROUP_ROOT
           value: /sys/fs/cgroup
         - name: BIN_PATH
           value: /opt/cni/bin
@@ -253,13 +253,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: apply-sysctl-overwrites
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         env:
         - name: BIN_PATH
           value: /opt/cni/bin
         command:
         - sh
@@ -283,13 +283,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: mount-bpf-fs
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         args:
         - mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
         command:
         - /bin/bash
         - -c
@@ -299,13 +299,13 @@

           privileged: true
         volumeMounts:
         - name: bpf-maps
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         command:
         - /init-container.sh
         env:
         - name: CILIUM_ALL_STATE
           valueFrom:
@@ -347,13 +347,13 @@

         - name: cilium-cgroup
           mountPath: /sys/fs/cgroup
           mountPropagation: HostToContainer
         - name: cilium-run
           mountPath: /var/run/cilium
       - name: install-cni-binaries
-        image: quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
+        image: quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
         imagePullPolicy: IfNotPresent
         command:
         - /install-plugin.sh
         resources:
           requests:
             cpu: 100m
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy

@@ -29,13 +29,13 @@

     spec:
       securityContext:
         appArmorProfile:
           type: Unconfined
       containers:
       - name: cilium-envoy
-        image: quay.io/cilium/cilium-envoy:v1.34.4-1754895458-68cffdfa568b6b226d70a7ef81fc65dda3b890bf@sha256:247e908700012f7ef56f75908f8c965215c26a27762f296068645eb55450bda2
+        image: quay.io/cilium/cilium-envoy:v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324@sha256:7932d656b63f6f866b6732099d33355184322123cfe1182e6f05175a3bc2e0e0
         imagePullPolicy: IfNotPresent
         command:
         - /usr/bin/cilium-envoy-starter
         args:
         - --
         - -c /var/run/cilium/envoy/bootstrap-config.json
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -20,25 +20,25 @@

       maxSurge: 25%
       maxUnavailable: 50%
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 4970d082f3251a10419e80b2a774fed7ea03f295fdf9746d92cf6d429d29e822
+        cilium.io/cilium-configmap-checksum: 427e188f36140497951fb3654ae066f7eda242999d77ad3282151a69fd109bda
       labels:
         io.cilium/app: operator
         name: cilium-operator
         app.kubernetes.io/part-of: cilium
         app.kubernetes.io/name: cilium-operator
     spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cilium-operator
-        image: quay.io/cilium/operator-generic:v1.18.1@sha256:97f4553afa443465bdfbc1cc4927c93f16ac5d78e4dd2706736e7395382201bc
+        image: quay.io/cilium/operator-generic:v1.18.2@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805
         imagePullPolicy: IfNotPresent
         command:
         - cilium-operator-generic
         args:
         - --config-dir=/tmp/cilium/config-map
         - --debug=$(CILIUM_DEBUG)
@@ -115,12 +115,14 @@

       - key: node-role.kubernetes.io/control-plane
         operator: Exists
       - key: node-role.kubernetes.io/master
         operator: Exists
       - key: node.kubernetes.io/not-ready
         operator: Exists
+      - key: node.cloudprovider.kubernetes.io/uninitialized
+        operator: Exists
       - key: node.cilium.io/agent-not-ready
         operator: Exists
       volumes:
       - name: cilium-config-path
         configMap:
           name: cilium-config
--- HelmRelease: kube-system/cilium ServiceMonitor: kube-system/cilium-agent

+++ HelmRelease: kube-system/cilium ServiceMonitor: kube-system/cilium-agent

@@ -3,12 +3,13 @@

 kind: ServiceMonitor
 metadata:
   name: cilium-agent
   namespace: kube-system
   labels:
     app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-agent
 spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: cilium-agent
   namespaceSelector:
     matchNames:

@binaryn3xus binaryn3xus merged commit fd835b2 into main Sep 19, 2025
11 checks passed
@binaryn3xus binaryn3xus deleted the renovate/ghcr.io-home-operations-charts-mirror-cilium-1.x branch September 19, 2025 17:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/kubernetes Changes made in the kubernetes directory renovate/container type/patch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant