Update module github.com/cilium/cilium to v1.18.5 by renovate[bot] · Pull Request #511 · linode/linode-cloud-controller-manager

renovate · 2025-12-20T02:50:06Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cilium/cilium	`v1.18.4` → `v1.18.5`

Release Notes

cilium/cilium (github.com/cilium/cilium)

`v1.18.5`: 1.18.5

Compare Source

Summary of Changes

Minor Changes:

[v1.18] proxy: Bump envoy version to v1.34.11 (#43143, @sayboras)
Change the sidecar etcd instance of the Cluster Mesh API Server listen on all IP addresses (Backport PR #42948, Upstream PR #42818, @giorio94)

Bugfixes:

allow missing verbs for cilium-agent cluster role when readSecretsOnlyFromSecretsNamespace is false (Backport PR #42948, Upstream PR #42790, @kraashen)
AWS EC2: Fix ENI attachment on multi-network card instances with high-performance networking (EFA) setups (Backport PR #42745, Upstream PR #42512, @41ks)
CiliumEnvoyConfig proxy ports are now restored on agent restarts. (Backport PR #43117, Upstream PR #43108, @jrajahalme)
Cleanup FQDNs that have leaked into the global FQDN cache (Backport PR #42864, Upstream PR #42485, @sjohnsonpal)
Do not opt-out Endpoint ID 1 from dnsproxy transparent mode. (Backport PR #42948, Upstream PR #42887, @jrajahalme)
ENI: Fix panic on nil subnet (Backport PR #43117, Upstream PR #43023, @HadrienPatte)
Ensure cilium-agent gracefully does fallbacks when etcd is in a bad state. (Backport PR #43059, Upstream PR #42977, @odinuge)
Fix a bug that would cause Cilium to not report L4 checksum update errors when the length attribute is missing in ICMP Error messages with TCP inner packets. (Backport PR #42828, Upstream PR #42426, @yushoyamaguchi)
Fix a bug that would cause IPsec logs to incorrectly report the XFRM rules being processed as "Ingress" rules. (Backport PR #42828, Upstream PR #42640, @sjohnsonpal)
Fix agent local identity leak (Backport PR #43117, Upstream PR #42662, @odinuge)
Fix bug that could cause the agent to fail to add XFRM states when IPsec is enabled, thus preventing a proper startup. (Backport PR #42948, Upstream PR #42666, @pchaigno)
Fix GC of per-cluster ctmap entries (Backport PR #43294, Upstream PR #43160, @giorio94)
Fix ipcache issues causing severe issues with the fqdn subsystem (Backport PR #42864, Upstream PR #42815, @odinuge)
Fix issue where endpoints got stuck in "waiting-to-regenerate" (Backport PR #42948, Upstream PR #42856, @odinuge)
Fix leak in the policy subsystem (Backport PR #43117, Upstream PR #42661, @odinuge)
Fix rare kvstore issue where cilium continues to use an expired lease causing kvstore operations to fail consistently (Backport PR #42745, Upstream PR #42709, @odinuge)
fqdn: Fix fqdn subsystem correctness issues causing packet drops and inconsistent ipcache (Backport PR #43117, Upstream PR #42500, @odinuge)
In rare cases, the cilium-operator losing the lead of the HA deployment could continue acting as if leading for at most a minute, leading to split-brain problems such as double allocation of pod CIDRs. (Backport PR #43059, Upstream PR #42920, @bimmlerd)
KVStoreMesh now correctly respects the CA bundle setting when validating remote cluster certificates (Backport PR #42828, Upstream PR #42726, @giorio94)
policy: Fix rare Endpoint Selector Policy Deadlock causing policies to not be updated with new identities (Backport PR #42864, Upstream PR #42306, @odinuge)
Recreate CiliumEndpoints (k8s resource) if they are accidentally deleted. (Backport PR #43117, Upstream PR #42877, @aanm)
redirectpolicy: Avoid recomputing on pod changes that do not change resulting redirect backends (Backport PR #42948, Upstream PR #42814, @joamaki)

CI Changes:

bpf: test: add BPF Masq tests for unknown / handled protocols (Backport PR #42711, Upstream PR #42144, @julianwiedmann)
bpf: test: egressgw: fix up ENABLE_MASQUERADE (Backport PR #42966, Upstream PR #42912, @julianwiedmann)
bpf: tests: add BPF MASQ test for ICMP ECHOs (Backport PR #42711, Upstream PR #42656, @julianwiedmann)
bpf: tests: set ENABLE_MASQUERADE_IPV6 for EGW XDP test (Backport PR #43059, Upstream PR #42962, @julianwiedmann)
bpf:test: cover host endpoint case in tc_nodeport_l3_dev.h (Backport PR #43059, Upstream PR #42983, @smagnani96)
Delete .github/workflows/build-images-hotfixes.yaml (Backport PR #42966, Upstream PR #42958, @sekhar-isovalent)
gh: conn-disrupt: fix XFRM error checks (Backport PR #42764, Upstream PR #42724, @julianwiedmann)
gh: ipsec-e2e: fix flaky connection disruptivity test (Backport PR #42823, Upstream PR #42780, @julianwiedmann)
gha: additionally cleanup disk space in clustermesh upgrade workflow (Backport PR #42948, Upstream PR #42862, @giorio94)
gha: don't filter lint-build-commits steps when workflow is modified (Backport PR #42948, Upstream PR #42844, @giorio94)
gha: wait for cert-manager CRDs to be ready in conformance clustermesh (Backport PR #42966, Upstream PR #42947, @giorio94)
makefile: More reliable update-helm-values (Backport PR #42828, Upstream PR #42736, @devodev)

Misc Changes:

.github/workflows: make adjustments for new GitHub workflow behavior (#43219, @aanm)
[v1.18] deps: bump x/crypto to v0.45.0 (#43114, @ferozsalam)
[v1.18] vendor: Bump to StateDB v0.4.6 (#42953, @joamaki)
chore(deps): update all github action dependencies (v1.18) (#42783, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#42937, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43036, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43181, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43268, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43317, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (patch) (#43314, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#42804, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#43037, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.18.9 (v1.18) (#43182, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.28 (v1.18) (#42771, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v33.1 (v1.18) (#42805, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v33.2 (v1.18) (#43184, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.11 (v1.18) (#43315, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to d80cd69 (v1.18) (#43312, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.10 docker digest to 7b13449 (v1.18) (#42935, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.10 docker digest to 83d7392 (v1.18) (#42802, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.11 docker digest to e3fb71a (v1.18) (#43313, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to 2b7c93f (v1.18) (#43135, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.6 (v1.18) (#42936, @cilium-renovate[bot])
chore(deps): update github artifact actions (v1.18) (#43318, @cilium-renovate[bot])
chore(deps): update go to v1.24.11 (v1.18) (#43183, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.3.1 (v1.18) (#43052, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#42803, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43316, @cilium-renovate[bot])
docs: Add limitation about LB to same backend via multiple VIPs (Backport PR #42745, Upstream PR #42632, @brb)
Documentation: host firewall: document emergency recovery (Backport PR #42948, Upstream PR #42776, @squeed)
fqdn: rewrite name manager test to use real ipcache (Backport PR #42948, Upstream PR #42820, @odinuge)
Minor improvements around certificate validation in etcd/clustermesh troubleshoot commands (Backport PR #42948, Upstream PR #42782, @giorio94)
node/manager: TestNodesStartupPruning poll state (Backport PR #42948, Upstream PR #41648, @0xch4z)
policy: Marshal L4Filter marshalling errors into json (Backport PR #42948, Upstream PR #42834, @joestringer)
xds: Do not log an error on a done context (Backport PR #43117, Upstream PR #42990, @jrajahalme)

Other Changes:

[v1.18] Add periodic resync for secret-sync controller (#43356, @youngnick)
[v1.18] bpf: lxc: transfer source identity for lxc-to-host policy (#42821, @julianwiedmann)
[v1.18] ipcache: Fix leak in CIDR metadata consolidation logic (#43354, @christarazi)
[v1.18] lb: Implement Hybrid-DSR via annotation infrastructure (#43056, @julianwiedmann)
[v1.18] proxy: Bump envoy version to v1.34.12 (#43259, @sayboras)
install: Update image digests for v1.18.4 (#42735, @cilium-release-bot[bot])
Kubernetes endpoints that are terminating are retained in the backends BPF state regardless of the "serving" condition to avoid connection disruptions when a pod no longer signals readiness to process new connections. (#42708, @joamaki)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
quay.io/cilium/cilium:stable@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.5@sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1
quay.io/cilium/clustermesh-apiserver:stable@sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1

docker-plugin

quay.io/cilium/docker-plugin:v1.18.5@sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f
quay.io/cilium/docker-plugin:stable@sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.5@sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446
quay.io/cilium/hubble-relay:stable@sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.5@sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c
quay.io/cilium/operator-alibabacloud:stable@sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c

operator-aws

quay.io/cilium/operator-aws:v1.18.5@sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52
quay.io/cilium/operator-aws:stable@sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52

operator-azure

quay.io/cilium/operator-azure:v1.18.5@sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6
quay.io/cilium/operator-azure:stable@sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6

operator-generic

quay.io/cilium/operator-generic:v1.18.5@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99
quay.io/cilium/operator-generic:stable@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99

operator

quay.io/cilium/operator:v1.18.5@sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606
quay.io/cilium/operator:stable@sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-12-20T02:50:08Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`github.com/cilium/statedb`	`v0.4.5` -> `v0.4.6`

codecov · 2025-12-20T02:53:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.72%. Comparing base (ed281b9) to head (e2209f6).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #511   +/-   ##
=======================================
  Coverage   73.72%   73.72%           
=======================================
  Files          19       19           
  Lines        2835     2835           
=======================================
  Hits         2090     2090           
  Misses        504      504           
  Partials      241      241

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Update module github.com/cilium/cilium to v1.18.5

e2209f6

renovate bot added the dependencies dependency updates including security fixes label Dec 20, 2025

renovate bot temporarily deployed to prod December 20, 2025 02:50 Inactive

komer3 approved these changes Jan 2, 2026

View reviewed changes

komer3 merged commit 26ccc23 into main Jan 2, 2026
12 checks passed

komer3 deleted the renovate/github.com-cilium-cilium-1.x branch January 2, 2026 17:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/cilium/cilium to v1.18.5#511

Update module github.com/cilium/cilium to v1.18.5#511
komer3 merged 1 commit intomainfrom
renovate/github.com-cilium-cilium-1.x

renovate bot commented Dec 20, 2025 •

edited

Loading

Uh oh!

renovate bot commented Dec 20, 2025

Uh oh!

codecov bot commented Dec 20, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Dec 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.18.5: 1.18.5

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

Configuration

Uh oh!

renovate bot commented Dec 20, 2025

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

codecov bot commented Dec 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Dec 20, 2025 •

edited

Loading

`v1.18.5`: 1.18.5

codecov bot commented Dec 20, 2025 •

edited

Loading