From 1.18.6 upgrade to 1.19 breaks l2 Announcement with sharing key

Is there an existing issue for this?

I have searched the existing issues

Version

equal or higher than v1.19.0 and lower than v1.20.0

What happened?

After upgrade to 1.19, we found that some services with l2 announcement are broken.

How can we reproduce the issue?

Further investigation revealed that only services using a sharing key (i.e., those sharing the same IP address but using different ports) were inaccessible from the internet. Services using independent IP addresses, however, functioned without issue.

Furthermore, rolling back Cilium to version 1.18.6 did not resolve the problem; each server had to be restarted after the rollback for network connectivity to be restored.

Cilium Version

1.19

Kernel Version

6.18.5 / 6.18.1

Kubernetes Version

v1.34.2

Regression

1.18.6

Cilium helm values

k8sServiceHost: "localhost"
k8sServicePort: "7445"
kubeProxyReplacement: 'true'

k8sClientRateLimit:
  qps: 200
  burst: 400
  operator:
    qps: 1000
    burst: 2000

bandwidthManager:
  enabled: true
  bbr: true

l2announcements:
  enabled: true
  leaseDuration: 60s
  leaseRenewDeadline: 40s
  leaseRetryPeriod: 10s

bpf:
  masquerade: true
  hostLegacyRouting: false

ingressController:
  default: true

cgroup:
  autoMount:
    enabled: false
  hostRoot: /sys/fs/cgroup

externalIPs:
  enabled: true

gatewayAPI:
  enableAlpn: true
  enableAppProtocol: true

ipam:
  operator:
    clusterPoolIPv4PodCIDRList: ["10.0.0.0/8"]
    clusterPoolIPv4MaskSize: 18
    clusterPoolIPv6PodCIDRList: ["fd00::/104"]
    clusterPoolIPv6MaskSize: 114

ipv6:
  enabled: true

loadBalancer:
  dsrDispatch: geneve
  mode: dsr

securityContext:
  capabilities:
    ciliumAgent:
      - CHOWN
      - KILL
      - NET_ADMIN
      - NET_RAW
      - IPC_LOCK
      - SYS_ADMIN
      - SYS_RESOURCE
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    cleanCiliumState:
      - NET_ADMIN
      - SYS_ADMIN
      - SYS_RESOURCE

operator:
  prometheus:
    enabled: true
    metricsService: true

prometheus:
  enabled: true
  metricsService: true

tunnelProtocol: geneve

Anything else?

OS: Talos Linux v1.12.0/v1.12.2

Cilium Users Document

Are you a user of Cilium? Please add yourself to the Users doc

Code of Conduct

I agree to follow this project's Code of Conduct

Thanks for the report. Looks like this is related with L2 Announcements (beta). For anyone interested in digging into this issue, a useful step would be to understand what the minimal set of steps are needed to reproduce the issue. Presumably it's a combination of installing Cilium with the values file shared in the issue description, then creating some L2 Announcement Policies. It would be helpful to also share the copies of those policies along with the steps.

I will share more information to help with possible reproduction. This is the policy we use:

apiVersion: "cilium.io/v2alpha1"
kind: CiliumL2AnnouncementPolicy
metadata:
  name: l2advert
spec:
  interfaces:
  - ens3f0
  externalIPs: true
  loadBalancerIPs: true

Our service will also have the following settings:

kind: Service
apiVersion: v1
metadata:
  name: svc-bqq6xnkl
  annotations:
    lbipam.cilium.io/ips: 110.x.x.x, 111.x.x.x
    lbipam.cilium.io/sharing-cross-namespace: '*'
    lbipam.cilium.io/sharing-key: public-share
spec:
  type: LoadBalancer
  externalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  allocateLoadBalancerNodePorts: false
  internalTrafficPolicy: Cluster

Further investigation revealed that only services using a sharing key (i.e., those sharing the same IP address but using different ports) were inaccessible from the internet.

All of the services sharing the same IP, or just some ports were working and some others not?

Further investigation revealed that only services using a sharing key (i.e., those sharing the same IP address but using different ports) were inaccessible from the internet.

All of the services sharing the same IP, or just some ports were working and some others not?

I didn't conduct a complete test at the time. A single IP address might have dozens of ports in use, belonging to different services. I tested at least five of them and found none that were accessible. However, the load balancer services annotated only with lbipam.cilium.io/ips were accessible normally.

@mhofstetter

Fixed in 1.20 with : l2announcer: re-evaluate services on frontend changes (Backport PR #47690, Upstream PR #47579, @mhofstetter) ?

@hugues-sauvage

@hugues-sauvage are you confirming that you experienced the issue before and that you no longer see the problem with v1.20.x? That would be great 🎉

I'll close this issue optimistically based on the above. If you still see this with v1.20 or above, feel free to comment below or open a fresh issue.

@mhofstetter

No. I haven't experienced anything. It's just Claude Anthropic looking in PR code in v1.20 and saying that it should fix the problem. May be @mhofstetter can validate.

@hugues-sauvage

@hugues-sauvage Oh. I've seen a lot of similar cases where LLM tools are hallucinating that something is fixed, because while the code text has a statistical correlation with a potential fix, it turns out that when you actually deploy Cilium in a live environment there are many more variables that the LLMs are not taking into account. So it's not overly helpful to post that some LLM generated text which hints it's fixed, because it doesn't tell us anything new. It tells us the fix is correlated but may or may not address the issue.

Either way sure maybe someone who is experiencing the bug can report back whether it's fixed or maybe Marco knows. I'll leave the bug closed optimistically anyway, pending a counter-report.

Navigation Menu

Repository navigation

From 1.18.6 upgrade to 1.19 breaks l2 Announcement with sharing key #44222

Is there an existing issue for this?

Version

What happened?

How can we reproduce the issue?

Cilium Version

Kernel Version

Kubernetes Version

Regression

Cilium helm values

Anything else?

Cilium Users Document

Code of Conduct

20 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

From 1.18.6 upgrade to 1.19 breaks l2 Announcement with sharing key #44222

Description

Is there an existing issue for this?

Version

What happened?

How can we reproduce the issue?

Cilium Version

Kernel Version

Kubernetes Version

Regression

Cilium helm values

Anything else?

Cilium Users Document

Code of Conduct

Activity

joestringer commented on Feb 6, 2026

StormYudi commented on Feb 6, 2026

msune commented on Feb 6, 2026

StormYudi commented on Feb 7, 2026

20 remaining items

github-actions commented on Apr 28, 2026

hugues-sauvage commented on Aug 25, 2026

joestringer commented on Aug 25, 2026

joestringer commented on Aug 27, 2026

hugues-sauvage commented on Aug 31, 2026

joestringer commented on Aug 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions