cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR #45755, Upstream PR #45504, @HadrienPatte)
iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR #45630, Upstream PR #45192, @liyihuang)
operator/spire: make SPIRE client configurable for ztunnel (Backport PR #45356, Upstream PR #44136, @nddq)
pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR #45630, Upstream PR #45533, @sjohnsonpal)

Bugfixes:

bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR #45695, Upstream PR #45661, @julianwiedmann)
bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR #45594, Upstream PR #45588, @julianwiedmann)
cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR #45888, Upstream PR #44951, @skymensch)
cilium: Fix incorrect IPv6 BIG TCP display (Backport PR #45630, Upstream PR #45529, @pchaigno)
clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR #45496, Upstream PR #45402, @MrFreezeex)
clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR #45630, Upstream PR #45576, @owayss)
Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR #45673, Upstream PR #44526, @nebojsaj1726)
Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR #45584, Upstream PR #45522, @ysksuzuki)
Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR #45888, Upstream PR #45737, @weizhoublue)
Fix host L7 policy operation (Backport PR #45496, Upstream PR #45030, @atykhyy)
Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR #45630, Upstream PR #44701, @hbangT)
Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR #45630, Upstream PR #45557, @jrife)
Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR #45356, Upstream PR #45179, @RiccardoAtzori91)
fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR #45630, Upstream PR #44705, @ieth0)
fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR #45630, Upstream PR #44662, @aslafy-z)
fix(ipsec): panic in parseSPI on malformed input (Backport PR #45496, Upstream PR #44815, @isoyuki)
Fixed intermittent ARP failures for LoadBalancer services caused by pointer reuse during BPF map iteration in the L2 responder reconciler. (Backport PR #45673, Upstream PR #45197, @Krishnachaitanyakc)
Fixed SocketLB returning EPERM instead of EHOSTUNREACH when a Service has no backends. (Backport PR #45673, Upstream PR #45185, @chez-shanpu)
Fixes an issue where L7 LoadBalancer and Ingress traffic would be dropped on certain kernel versions when Cilium is attached to a bridge network device. (Backport PR #45755, Upstream PR #45582, @liyihuang)
Fixes dropped packets on ingress when full header not in linear skb area (Backport PR #45496, Upstream PR #45195, @javiercardona-work)
hubble-relay: fix TLS config variable shadowing preventing cleanup on shutdown (Backport PR #45630, Upstream PR #45085, @Aprazor)
policy: Fix CCG matching for duplicate label keys (Backport PR #45356, Upstream PR #45225, @christarazi)
Respect backends for BGP only when they are in state: active (Backport PR #45673, Upstream PR #45286, @CallMeFoxie)
secretsync recreate synced secret when source secret type changes (Backport PR #45888, Upstream PR #45721, @ssam18)
wireguard: clamp cilium_wg0 MTU to IPV6_MIN_MTU (1280) when IPv6 is enabled, preventing silent packet loss in tunnel+encryption mode with constrained path MTU (Backport PR #45496, Upstream PR #45425, @tibrezus)

CI Changes:

.github/workflows: skip full test suite for workflow_dispatch on dev … (Backport PR #45356, Upstream PR #45285, @aanm)
complexity-diff: Small improvements (Backport PR #45673, Upstream PR #45556, @pchaigno)
contrib: fix typo in identity_is_node.cocci (Backport PR #45630, Upstream PR #45505, @julianwiedmann)
datapath/loader: Add map count to verifier complexity records (Backport PR #45673, Upstream PR #44652, @dylandreimerink)
gha/clustermesh: use OCI registry for cert-manager (Backport PR #45356, Upstream PR #45326, @giorio94)
logging: Update leader election log level override (Backport PR #45496, Upstream PR #45358, @joamaki)
Use extra power github runner if available for multi-pool CI workflow (Backport PR #45673, Upstream PR #45555, @fristonio)

Misc Changes:

[v1.19] deps: bump x/net to v0.53 (#45935, @ferozsalam)
Add documentation and warnings on DNS interception (Backport PR #45888, Upstream PR #45525, @ferozsalam)
chore(deps): update all external docker images dependencies to v0.13.5 (v1.19) (patch) (#45462, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#45467, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#45728, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#45747, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#45870, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#45882, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#45466, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#45615, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#45729, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.10 (v1.19) (#45902, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 354584b (v1.19) (#45614, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 6663075 (v1.19) (#45481, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 6e3229e (v1.19) (#45620, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to b782452 (v1.19) (#45488, @cilium-renovate[bot])
chore(deps): update dependency bufbuild/buf to v1.69.0 (v1.19) (#45872, @cilium-renovate[bot])
chore(deps): update module github.com/moby/spdystream to v0.5.1 [security] (v1.19) (#45431, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260416084302-2b3d1fe14578 (v1.19) (#45463, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260423112246-3fa174937a6b (v1.19) (#45730, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260505141229-de8f85687fd2 (v1.19) (#45881, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.3 (v1.19) (#45501, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.6-1776352947-78da350f53f63526ff6487f2e1f3b14d2062ce17 (v1.19) (#45464, @cilium-renovate[bot])
ci: make registry configurable (#45437, @Artyop)
docs(policy): update namespace label support (Backport PR #45630, Upstream PR #44922, @lconnery)
docs: add small CiliumCIDRGroup scalability callout (Backport PR #45888, Upstream PR #45763, @squeed)
Fail hive health tree script command if no status is found for filter (Backport PR #45888, Upstream PR #45554, @fristonio)
Fix Endpoint regeneration health reporting (Backport PR #45630, Upstream PR #45011, @fristonio)
fix(deps): update k8s.io patch updates stable to v0.35.4 (v1.19) (patch) (#45465, @cilium-renovate[bot])
helm: allow overriding of external images in charts (Backport PR #45634, Upstream PR #45597, @sekhar-isovalent)
helm: do not set operator health port as hostPort when hostNetwork is disabled (Backport PR #45673, Upstream PR #45386, @robinelfrink)
loadbalancer/reflectors: Filter EndpointSlice watch by service labels (Backport PR #45755, Upstream PR #45528, @HadrienPatte)

Other Changes:

[v1.19] ipam: fix data race in MultiPoolManager node update (#45521, @Kunalbehbud)
chore(deps): update quay.io/cilium/cilium-envoy (#45908, @sayboras)
install: Restore RBAC for ciliumbgppeeringpolicies to allow for gradual upgrade of Cilium pods from v1.18 to v1.19. (#45829, @rastislavs)
install: Update image digests for v1.19.3 (#45401, @cilium-release-bot[bot])
v1.19: bpf: Reduce stack usage and complexity of tail_handle_snat_fwd_ipv6 (#45360, @pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.4@sha256:9e40006b2e2b6e66d047f9af52577a93b39d9532958ec6d88d46820bb59ab643

docker-plugin

quay.io/cilium/docker-plugin:v1.19.4@sha256:720dc5839de8c30acf655ad790866cf89b7691047a020e7b4a4bd66883fbf4d1

hubble-relay

quay.io/cilium/hubble-relay:v1.19.4@sha256:59af8c0d561e560c2a042e7600a3496bc0367df8fbf868aa68d5834c8ec1a431

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.4@sha256:693b1e61f22beaa9a0f68aa4056ba873465da96da6382f3276978d01544450dd

operator-aws

quay.io/cilium/operator-aws:v1.19.4@sha256:9e41b3959d941a0b60ba187f5a2572305846248efb89ac59c18fd25a032f568d

operator-azure

quay.io/cilium/operator-azure:v1.19.4@sha256:8203f4e5e65c658fe2367a570c7bba5779859982bd3cc263662e35e690be3417

operator-generic

quay.io/cilium/operator-generic:v1.19.4@sha256:1aa2b62735e7d8ab49ee840ae59c346932024c88901579121395c1271b435f71

operator

quay.io/cilium/operator:v1.19.4@sha256:7edc61725901e32a13e180c5290d43df5292f5f49c6d654c94a0be2faf52e71e

Configuration

📅 Schedule: (in timezone America/Toronto)

Branch creation
- "every weekday"
Automerge
- "every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.19.3` → `1.19.4` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/47) for more information. --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.19.4`](https://github.com/cilium/cilium/releases/tag/v1.19.4): 1.19.4 [Compare Source](https://github.com/cilium/cilium/compare/1.19.3...1.19.4) ## Summary of Changes **Minor Changes:** - cilium-agent: when `--k8s-service-proxy-name` is set, `EndpointSlices` are now filtered by the `service.kubernetes.io/service-proxy-name` label at the watch level, matching how `Services` are already filtered, operators with hand-managed `EndpointSlices` must stamp the matching label on those slices. (Backport PR [#45755](https://github.com/cilium/cilium/issues/45755), Upstream PR [#45504](https://github.com/cilium/cilium/issues/45504), [@HadrienPatte](https://github.com/HadrienPatte)) - iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45192](https://github.com/cilium/cilium/issues/45192), [@liyihuang](https://github.com/liyihuang)) - operator/spire: make SPIRE client configurable for ztunnel (Backport PR [#45356](https://github.com/cilium/cilium/issues/45356), Upstream PR [#44136](https://github.com/cilium/cilium/issues/44136), [@nddq](https://github.com/nddq)) - pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45533](https://github.com/cilium/cilium/issues/45533), [@sjohnsonpal](https://github.com/sjohnsonpal)) **Bugfixes:** - bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR [#45695](https://github.com/cilium/cilium/issues/45695), Upstream PR [#45661](https://github.com/cilium/cilium/issues/45661), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR [#45594](https://github.com/cilium/cilium/issues/45594), Upstream PR [#45588](https://github.com/cilium/cilium/issues/45588), [@julianwiedmann](https://github.com/julianwiedmann)) - cilium-dbg: `cilium map list` now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR [#45888](https://github.com/cilium/cilium/issues/45888), Upstream PR [#44951](https://github.com/cilium/cilium/issues/44951), [@skymensch](https://github.com/skymensch)) - cilium: Fix incorrect IPv6 BIG TCP display (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45529](https://github.com/cilium/cilium/issues/45529), [@pchaigno](https://github.com/pchaigno)) - clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR [#45496](https://github.com/cilium/cilium/issues/45496), Upstream PR [#45402](https://github.com/cilium/cilium/issues/45402), [@MrFreezeex](https://github.com/MrFreezeex)) - clustermesh: Fix Helm typo preventing to add annotations when setting `clustermesh.apiserver.tls.auto.method: certmanager` (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45576](https://github.com/cilium/cilium/issues/45576), [@owayss](https://github.com/owayss)) - Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#44526](https://github.com/cilium/cilium/issues/44526), [@nebojsaj1726](https://github.com/nebojsaj1726)) - Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR [#45584](https://github.com/cilium/cilium/issues/45584), Upstream PR [#45522](https://github.com/cilium/cilium/issues/45522), [@ysksuzuki](https://github.com/ysksuzuki)) - Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR [#45888](https://github.com/cilium/cilium/issues/45888), Upstream PR [#45737](https://github.com/cilium/cilium/issues/45737), [@weizhoublue](https://github.com/weizhoublue)) - Fix host L7 policy operation (Backport PR [#45496](https://github.com/cilium/cilium/issues/45496), Upstream PR [#45030](https://github.com/cilium/cilium/issues/45030), [@atykhyy](https://github.com/atykhyy)) - Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#44701](https://github.com/cilium/cilium/issues/44701), [@hbangT](https://github.com/hbangT)) - Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45557](https://github.com/cilium/cilium/issues/45557), [@jrife](https://github.com/jrife)) - Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR [#45356](https://github.com/cilium/cilium/issues/45356), Upstream PR [#45179](https://github.com/cilium/cilium/issues/45179), [@RiccardoAtzori91](https://github.com/RiccardoAtzori91)) - fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#44705](https://github.com/cilium/cilium/issues/44705), [@ieth0](https://github.com/ieth0)) - fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#44662](https://github.com/cilium/cilium/issues/44662), [@aslafy-z](https://github.com/aslafy-z)) - fix(ipsec): panic in parseSPI on malformed input (Backport PR [#45496](https://github.com/cilium/cilium/issues/45496), Upstream PR [#44815](https://github.com/cilium/cilium/issues/44815), [@isoyuki](https://github.com/isoyuki)) - Fixed intermittent ARP failures for LoadBalancer services caused by pointer reuse during BPF map iteration in the L2 responder reconciler. (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#45197](https://github.com/cilium/cilium/issues/45197), [@Krishnachaitanyakc](https://github.com/Krishnachaitanyakc)) - Fixed SocketLB returning EPERM instead of EHOSTUNREACH when a Service has no backends. (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#45185](https://github.com/cilium/cilium/issues/45185), [@chez-shanpu](https://github.com/chez-shanpu)) - Fixes an issue where L7 LoadBalancer and Ingress traffic would be dropped on certain kernel versions when Cilium is attached to a bridge network device. (Backport PR [#45755](https://github.com/cilium/cilium/issues/45755), Upstream PR [#45582](https://github.com/cilium/cilium/issues/45582), [@liyihuang](https://github.com/liyihuang)) - Fixes dropped packets on ingress when full header not in linear skb area (Backport PR [#45496](https://github.com/cilium/cilium/issues/45496), Upstream PR [#45195](https://github.com/cilium/cilium/issues/45195), [@javiercardona-work](https://github.com/javiercardona-work)) - hubble-relay: fix TLS config variable shadowing preventing cleanup on shutdown (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45085](https://github.com/cilium/cilium/issues/45085), [@Aprazor](https://github.com/Aprazor)) - policy: Fix CCG matching for duplicate label keys (Backport PR [#45356](https://github.com/cilium/cilium/issues/45356), Upstream PR [#45225](https://github.com/cilium/cilium/issues/45225), [@christarazi](https://github.com/christarazi)) - Respect backends for BGP only when they are in state: active (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#45286](https://github.com/cilium/cilium/issues/45286), [@CallMeFoxie](https://github.com/CallMeFoxie)) - secretsync recreate synced secret when source secret type changes (Backport PR [#45888](https://github.com/cilium/cilium/issues/45888), Upstream PR [#45721](https://github.com/cilium/cilium/issues/45721), [@ssam18](https://github.com/ssam18)) - wireguard: clamp cilium\_wg0 MTU to IPV6\_MIN\_MTU (1280) when IPv6 is enabled, preventing silent packet loss in tunnel+encryption mode with constrained path MTU (Backport PR [#45496](https://github.com/cilium/cilium/issues/45496), Upstream PR [#45425](https://github.com/cilium/cilium/issues/45425), [@tibrezus](https://github.com/tibrezus)) **CI Changes:** - .github/workflows: skip full test suite for workflow\_dispatch on dev … (Backport PR [#45356](https://github.com/cilium/cilium/issues/45356), Upstream PR [#45285](https://github.com/cilium/cilium/issues/45285), [@aanm](https://github.com/aanm)) - complexity-diff: Small improvements (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#45556](https://github.com/cilium/cilium/issues/45556), [@pchaigno](https://github.com/pchaigno)) - contrib: fix typo in identity\_is\_node.cocci (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45505](https://github.com/cilium/cilium/issues/45505), [@julianwiedmann](https://github.com/julianwiedmann)) - datapath/loader: Add map count to verifier complexity records (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#44652](https://github.com/cilium/cilium/issues/44652), [@dylandreimerink](https://github.com/dylandreimerink)) - gha/clustermesh: use OCI registry for cert-manager (Backport PR [#45356](https://github.com/cilium/cilium/issues/45356), Upstream PR [#45326](https://github.com/cilium/cilium/issues/45326), [@giorio94](https://github.com/giorio94)) - logging: Update leader election log level override (Backport PR [#45496](https://github.com/cilium/cilium/issues/45496), Upstream PR [#45358](https://github.com/cilium/cilium/issues/45358), [@joamaki](https://github.com/joamaki)) - Use extra power github runner if available for multi-pool CI workflow (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#45555](https://github.com/cilium/cilium/issues/45555), [@fristonio](https://github.com/fristonio)) **Misc Changes:** - \[v1.19] deps: bump x/net to v0.53 ([#45935](https://github.com/cilium/cilium/issues/45935), [@ferozsalam](https://github.com/ferozsalam)) - Add documentation and warnings on DNS interception (Backport PR [#45888](https://github.com/cilium/cilium/issues/45888), Upstream PR [#45525](https://github.com/cilium/cilium/issues/45525), [@ferozsalam](https://github.com/ferozsalam)) - chore(deps): update all external docker images dependencies to v0.13.5 (v1.19) (patch) ([#45462](https://github.com/cilium/cilium/issues/45462), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#45467](https://github.com/cilium/cilium/issues/45467), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#45728](https://github.com/cilium/cilium/issues/45728), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#45747](https://github.com/cilium/cilium/issues/45747), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#45870](https://github.com/cilium/cilium/issues/45870), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#45882](https://github.com/cilium/cilium/issues/45882), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#45466](https://github.com/cilium/cilium/issues/45466), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#45615](https://github.com/cilium/cilium/issues/45615), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#45729](https://github.com/cilium/cilium/issues/45729), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.25.10 (v1.19) ([#45902](https://github.com/cilium/cilium/issues/45902), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`354584b`](https://github.com/cilium/cilium/commit/354584b) (v1.19) ([#45614](https://github.com/cilium/cilium/issues/45614), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`6663075`](https://github.com/cilium/cilium/commit/6663075) (v1.19) ([#45481](https://github.com/cilium/cilium/issues/45481), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`6e3229e`](https://github.com/cilium/cilium/commit/6e3229e) (v1.19) ([#45620](https://github.com/cilium/cilium/issues/45620), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`b782452`](https://github.com/cilium/cilium/commit/b782452) (v1.19) ([#45488](https://github.com/cilium/cilium/issues/45488), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency bufbuild/buf to v1.69.0 (v1.19) ([#45872](https://github.com/cilium/cilium/issues/45872), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module github.com/moby/spdystream to v0.5.1 \[security] (v1.19) ([#45431](https://github.com/cilium/cilium/issues/45431), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260416084302-2b3d1fe14578 (v1.19) ([#45463](https://github.com/cilium/cilium/issues/45463), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260423112246-3fa174937a6b (v1.19) ([#45730](https://github.com/cilium/cilium/issues/45730), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260505141229-de8f85687fd2 (v1.19) ([#45881](https://github.com/cilium/cilium/issues/45881), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/certgen docker tag to v0.4.3 (v1.19) ([#45501](https://github.com/cilium/cilium/issues/45501), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.6-1776352947-78da350f53f63526ff6487f2e1f3b14d2062ce17 (v1.19) ([#45464](https://github.com/cilium/cilium/issues/45464), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ci: make registry configurable ([#45437](https://github.com/cilium/cilium/issues/45437), [@Artyop](https://github.com/Artyop)) - docs(policy): update namespace label support (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#44922](https://github.com/cilium/cilium/issues/44922), [@lconnery](https://github.com/lconnery)) - docs: add small CiliumCIDRGroup scalability callout (Backport PR [#45888](https://github.com/cilium/cilium/issues/45888), Upstream PR [#45763](https://github.com/cilium/cilium/issues/45763), [@squeed](https://github.com/squeed)) - Fail hive health tree script command if no status is found for filter (Backport PR [#45888](https://github.com/cilium/cilium/issues/45888), Upstream PR [#45554](https://github.com/cilium/cilium/issues/45554), [@fristonio](https://github.com/fristonio)) - Fix Endpoint regeneration health reporting (Backport PR [#45630](https://github.com/cilium/cilium/issues/45630), Upstream PR [#45011](https://github.com/cilium/cilium/issues/45011), [@fristonio](https://github.com/fristonio)) - fix(deps): update k8s.io patch updates stable to v0.35.4 (v1.19) (patch) ([#45465](https://github.com/cilium/cilium/issues/45465), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - helm: allow overriding of external images in charts (Backport PR [#45634](https://github.com/cilium/cilium/issues/45634), Upstream PR [#45597](https://github.com/cilium/cilium/issues/45597), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - helm: do not set operator health port as hostPort when hostNetwork is disabled (Backport PR [#45673](https://github.com/cilium/cilium/issues/45673), Upstream PR [#45386](https://github.com/cilium/cilium/issues/45386), [@robinelfrink](https://github.com/robinelfrink)) - loadbalancer/reflectors: Filter `EndpointSlice` watch by service labels (Backport PR [#45755](https://github.com/cilium/cilium/issues/45755), Upstream PR [#45528](https://github.com/cilium/cilium/issues/45528), [@HadrienPatte](https://github.com/HadrienPatte)) **Other Changes:** - \[v1.19] ipam: fix data race in MultiPoolManager node update ([#45521](https://github.com/cilium/cilium/issues/45521), [@Kunalbehbud](https://github.com/Kunalbehbud)) - chore(deps): update quay.io/cilium/cilium-envoy ([#45908](https://github.com/cilium/cilium/issues/45908), [@sayboras](https://github.com/sayboras)) - install: Restore RBAC for ciliumbgppeeringpolicies to allow for gradual upgrade of Cilium pods from `v1.18` to `v1.19`. ([#45829](https://github.com/cilium/cilium/issues/45829), [@rastislavs](https://github.com/rastislavs)) - install: Update image digests for v1.19.3 ([#45401](https://github.com/cilium/cilium/issues/45401), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - v1.19: bpf: Reduce stack usage and complexity of `tail_handle_snat_fwd_ipv6` ([#45360](https://github.com/cilium/cilium/issues/45360), [@pchaigno](https://github.com/pchaigno)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.4@sha256:9e40006b2e2b6e66d047f9af52577a93b39d9532958ec6d88d46820bb59ab643` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.4@sha256:720dc5839de8c30acf655ad790866cf89b7691047a020e7b4a4bd66883fbf4d1` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.4@sha256:59af8c0d561e560c2a042e7600a3496bc0367df8fbf868aa68d5834c8ec1a431` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.4@sha256:693b1e61f22beaa9a0f68aa4056ba873465da96da6382f3276978d01544450dd` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.4@sha256:9e41b3959d941a0b60ba187f5a2572305846248efb89ac59c18fd25a032f568d` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.4@sha256:8203f4e5e65c658fe2367a570c7bba5779859982bd3cc263662e35e690be3417` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.4@sha256:1aa2b62735e7d8ab49ee840ae59c346932024c88901579121395c1271b435f71` ##### operator `quay.io/cilium/operator:v1.19.4@sha256:7edc61725901e32a13e180c5290d43df5292f5f49c6d654c94a0be2faf52e71e` </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Toronto) - Branch creation - "every weekday" - Automerge - "every weekday" 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

dusk-bot added the

renovate/container

type/patch

priority/low

labels

2026-05-22 02:37:22 +00:00

dusk-bot added 1 commit

2026-05-22 02:37:22 +00:00

fix(container): update image quay.io/cilium/charts/cilium (1.19.3 ➔ 1.19.4)

Image Pull / Image Pull - Filter (pull_request_target) Successful in 5s

Details

Flux Local / Flux Local - Filter (pull_request_target) Successful in 6s