docs: add CNI chaining guide for Oracle Kubernetes Engine (OKE) by amaanx86 · Pull Request #46116 · cilium/cilium

amaanx86 · 2026-05-22T09:46:11Z

Add installation guide covering how to run Cilium in chaining mode on OKE with VCN-Native Pod Networking using cni.chainingTarget=oci. Cilium auto-discovers the existing oci conflist and injects itself via generic-veth without requiring a custom CNI ConfigMap.

Tested on OKE with Oracle Linux 8.10, kernel 5.15.0 UEK, Kubernetes 1.36.0, Cilium 1.19.4.

Checklist

For first time contributors, read Submitting a pull request
All code is covered by unit and/or runtime tests where feasible.
All commits contain a well written commit description including a title, description and a Fixes: #XXX line if the commit addresses a particular GitHub issue.
All commits are signed off. See the section Developer's Certificate of Origin
Provide a title or release-note blurb suitable for the release notes.
AI Influence Level statement below.

Fixes: #46107

Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking.

This document was formalized with AI assistance (AIL:3). The content, helm commands, architecture explanation, and all steps were written and tested personally on a live OKE cluster. I verified each step end to end before opening this PR.

amaanx86 · 2026-05-23T15:22:17Z

Could a maintainer please add the release-note/misc label? This is a documentation-only PR and the release-note block is already included in the description. The dont-merge/needs-release-note-label label appears to be blocking automated checks. Thanks!

amaanx86 · 2026-05-25T19:30:00Z

@HadrienPatte - you left a comment on #46107 so I figured you might be the right person to ping here.

I saw the CFP and the CCM work, and I agree the native path is the right long-term direction. This PR is just a stopgap doc for operators who need something today - it works on a live cluster without any code changes.

To give you some context on why this matters - my team requires an official Cilium doc reference before we can run anything in production. The chaining approach works, I have tested it, but without a doc in the Cilium installation guides I cannot get internal approval to deploy it. We do not experiment in production. An official page is the reference I need to take this to management.

Could you take a look when you get a chance? Also if you can add the release-note/misc label that would unblock the CI check.

amaanx86 · 2026-06-01T15:07:41Z

Error: buildx failed with: ERROR: failed to build: failed to solve: failed to push quay.io/cilium/cilium-cli-ci:e3e874a577fb480b95e7c4b335928232719f4428: denied: System is currently read-only. Pulls will succeed but all write operations are currently suspended.

CI failure on image push is due to a quay.io registry outage (read-only mode). Not related to this PR. Will need a re-run once quay.io recovers.

hemanthmalla · 2026-06-05T18:58:21Z

@antonipp / @HadrienPatte would you mind reviewing this for correctness ? Or tag relevant folks from oracle for their thoughts ?

HadrienPatte · 2026-06-15T09:26:12Z

👋 I'm working on testing this out on an OKE environment, will report back once I've validated the guide being proposed here

github-actions · 2026-07-16T02:14:31Z

This pull request has been automatically marked as stale because it
has not had recent activity. It will be closed if no further activity
occurs. Thank you for your contributions.

amaanx86 · 2026-07-22T14:04:59Z

Hi @HadrienPatte did you get a chance to check this doc out?

HadrienPatte · 2026-07-23T13:18:30Z

hey 👋 really sorry it took this long but the good news is that I was able to fully validate the proposed guide under an OKE environment and everything works as expected.

Cluster snapshot:

$ kubectl get po -A
NAMESPACE     NAME                                      READY   STATUS      RESTARTS   AGE
kube-system   kube-dns-autoscaler-7c4896fc96-qrx6l      1/1     Running     0          41m
kube-system   vcn-native-ip-cni-twtxp                   2/2     Running     0          36m
kube-system   proxymux-client-t9xpq                     1/1     Running     0          36m
kube-system   kube-proxy-gd929                          1/1     Running     0          36m
kube-system   csi-oci-node-qzqht                        1/1     Running     0          36m
kube-system   csi-oci-node-k45f4                        1/1     Running     0          36m
kube-system   vcn-native-ip-cni-gx94p                   2/2     Running     0          36m
kube-system   proxymux-client-6q45k                     1/1     Running     0          36m
kube-system   kube-proxy-t52nv                          1/1     Running     0          36m
kube-system   oke-node-problem-detector-lgxqv           1/1     Running     0          35m
kube-system   oke-dataplane-observability-agent-29mx8   2/2     Running     0          35m
kube-system   oke-dataplane-observability-agent-s2cwz   2/2     Running     0          35m
kube-system   oke-node-problem-detector-n7xg2           1/1     Running     0          35m
kube-system   cilium-envoy-6d9xs                        1/1     Running     0          31m
kube-system   cilium-4zzhs                              1/1     Running     0          31m
kube-system   cilium-operator-5bdbf7d9b4-9nkf2          1/1     Running     0          31m
kube-system   cilium-envoy-xdx9g                        1/1     Running     0          31m
kube-system   cilium-c77pb                              1/1     Running     0          31m
kube-system   cilium-operator-5bdbf7d9b4-g85nv          1/1     Running     0          31m
kube-system   coredns-6bc557ccf9-v5swg                  1/1     Running     0          20m
kube-system   coredns-6bc557ccf9-gnbwr                  1/1     Running     0          20m
default       client                                    1/1     Running     0          17m
default       web-7fcb6d48cb-fgb6d                      1/1     Running     0          17m
default       web-7fcb6d48cb-f7ttq                      1/1     Running     0          17m

Test CNP:

$ kubectl get -n default cnp web-allow-client -oyaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  creationTimestamp: "2026-07-23T12:49:26Z"
  generation: 1
  name: web-allow-client
  namespace: default
  resourceVersion: "10041"
  uid: 08cb45b0-b1d2-4727-b666-4144c6bade94
spec:
  endpointSelector:
    matchLabels:
      app: web
  ingress:
  - fromEndpoints:
    - matchLabels:
        policy-test: allowed
status:
  conditions:
  - lastTransitionTime: "2026-07-23T12:49:26Z"
    message: Policy validation succeeded
    status: "True"
    type: Valid

Testing:

$ kubectl label pod client policy-test=allowed --overwrite
pod/client labeled
$ # expect connectivity to work
$ kubectl exec client -- curl -sS -I http://$(kubectl get pod -l app=web -o jsonpath='{.items[0].status.podIP}'):8080/ | head -1
HTTP/1.1 200 OK
$ kubectl label pod client policy-test- --overwrite
pod/client unlabeled
$ # expect connectivity to be dropped
$ kubectl exec client -- curl -sS -m5 -I http://$(kubectl get pod -l app=web -o jsonpath='{.items[0].status.podIP}'):8080/ | head -1
curl: (28) Connection timed out after 5002 milliseconds
command terminated with exit code 28

Chaining config is in place:

$ kubectl -n kube-system exec $(kubectl -n kube-system get pod -l k8s-app=cilium -o jsonpath='{.items[0].metadata.name}') -c cilium-agent -- cat /host/etc/cni/net.d/05-cilium.conflist
{"name":"oci","cniVersion":"0.3.1","plugins":[{"cniVersion":"0.3.1","type":"oci-ipvlan","mode":"l2","ipam":{"type":"oci-ipam"}},{"cniVersion":"0.3.1","type":"oci-ptp","containerInterface":"ptp-veth0","mtu":9000},
{
        "type": "cilium-cni",
        "chaining-mode": "generic-veth",
        "enable-debug": false,
        "log-file": "/var/run/cilium/cilium-cni.log"
}
]}%
$ kubectl -n kube-system exec $(kubectl -n kube-system get pod -l k8s-app=cilium -o jsonpath='{.items[0].metadata.name}') -c cilium-agent -- cilium-dbg status
KVStore:                 Disabled
Kubernetes:              Ok         1.36 (v1.36.1) [linux/amd64]
Kubernetes APIs:         ["cilium/v2::CiliumCIDRGroup", "cilium/v2::CiliumClusterwideNetworkPolicy", "cilium/v2::CiliumEndpoint", "cilium/v2::CiliumNetworkPolicy", "cilium/v2::CiliumNode", "core/v1::Pods", "networking.k8s.io/v1::NetworkPolicy"]
KubeProxyReplacement:    False
Host firewall:           Disabled
SRv6:                    Disabled
CNI Chaining:            generic-veth
CNI Config file:         successfully wrote CNI configuration file to /host/etc/cni/net.d/05-cilium.conflist
Cilium:                  Ok   1.19.6 (v1.19.6-9a898243)
NodeMonitor:             Listening for events on 4 CPUs with 64x4096 of shared memory
Cilium health daemon:    Ok
IPAM:                    IPv4: 1/254 allocated from 100.64.1.0/24,
IPv4 BIG TCP:            Disabled
IPv6 BIG TCP:            Disabled
BandwidthManager:        Disabled
Routing:                 Network: Native   Host: Legacy
Attach Mode:             Legacy TC
Device Mode:             veth
Masquerading:            Disabled
Controller Status:       26/26 healthy
Proxy Status:            OK, ip 100.64.1.149, 0 redirects active on ports 10000-20000, Envoy: external
Global Identity Range:   min 256, max 65535
Hubble:                  Ok         Current/Max Flows: 4095/4095 (100.00%), Flows/s: 1.91   Metrics: Disabled
Encryption:              Disabled
Cluster health:          Probe disabled

HadrienPatte · 2026-07-28T19:59:47Z

/test

joestringer · 2026-07-28T20:19:25Z

I think the remaining tests are not triggering because this PR is based on a too old version of the main branch. You'll need to rebase on top of main in order to trigger the full testsuite.

Add installation guide covering how to run Cilium in chaining mode on OKE with VCN-Native Pod Networking using cni.chainingTarget=oci. Cilium auto-discovers the existing oci conflist and injects itself via generic-veth without requiring a custom CNI ConfigMap. Tested on OKE with Oracle Linux 8.10, kernel 5.15.0 UEK, Kubernetes 1.36.0, Cilium 1.19.4. Signed-off-by: Amaan Ul Haq Siddiqui <[email protected]>

Signed-off-by: Amaan Ul Haq Siddiqui <[email protected]>

Cilium writes 05-cilium.conflist, not 10-oci.conflist. Remove kernel version requirements and version-bound values from the JSON example to keep the doc stable across OKE releases. Signed-off-by: Amaan Ul Haq Siddiqui <[email protected]>

helm uninstall does not remove host path files written by the Cilium DaemonSet. The 05-cilium.conflist file remains on each node and blocks new pod creation with a cilium.sock connection error. Document the manual cleanup step required after uninstall. Signed-off-by: Amaan Ul Haq Siddiqui <[email protected]>

These terms appear in the OKE CNI chaining guide and are valid technical words: ARP (Address Resolution Protocol), VCN (Oracle Virtual Cloud Network), and conflist (CNI configuration list file). Signed-off-by: Amaan Ul Haq Siddiqui <[email protected]>

amaanx86 · 2026-07-28T20:44:37Z

@joestringer done

joestringer · 2026-07-28T20:49:12Z

/test

joestringer · 2026-07-29T14:23:16Z

/test

….20.1) (#430) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](cilium/cilium@1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](cilium/cilium#47615), Upstream PR [#47351](cilium/cilium#47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47148](cilium/cilium#47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47529](cilium/cilium#47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47449](cilium/cilium#47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47640](cilium/cilium#47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](cilium/cilium#47621), Upstream PR [#47343](cilium/cilium#47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47824](cilium/cilium#47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47838](cilium/cilium#47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47625](cilium/cilium#47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47880](cilium/cilium#47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47741](cilium/cilium#47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47583](cilium/cilium#47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47765](cilium/cilium#47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](cilium/cilium#47967), Upstream PR [#47802](cilium/cilium#47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47727](cilium/cilium#47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47295](cilium/cilium#47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47552](cilium/cilium#47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47593](cilium/cilium#47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47754](cilium/cilium#47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46842](cilium/cilium#46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47840](cilium/cilium#47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47766](cilium/cilium#47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46696](cilium/cilium#46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47457](cilium/cilium#47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47702](cilium/cilium#47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47627](cilium/cilium#47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47208](cilium/cilium#47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47579](cilium/cilium#47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47826](cilium/cilium#47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47890](cilium/cilium#47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47844](cilium/cilium#47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47791](cilium/cilium#47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47614](cilium/cilium#47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47535](cilium/cilium#47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47534](cilium/cilium#47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47792](cilium/cilium#47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47753](cilium/cilium#47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47470](cilium/cilium#47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47569](cilium/cilium#47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47743](cilium/cilium#47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47060](cilium/cilium#47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47608](cilium/cilium#47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47616](cilium/cilium#47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47364](cilium/cilium#47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47605](cilium/cilium#47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47771](cilium/cilium#47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47801](cilium/cilium#47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47691](cilium/cilium#47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47719](cilium/cilium#47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47703](cilium/cilium#47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47717](cilium/cilium#47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47724](cilium/cilium#47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47205](cilium/cilium#47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47780](cilium/cilium#47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47426](cilium/cilium#47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47725](cilium/cilium#47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47612](cilium/cilium#47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46116](cilium/cilium#46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47455](cilium/cilium#47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47762](cilium/cilium#47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47582](cilium/cilium#47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47592](cilium/cilium#47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47388](cilium/cilium#47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47841](cilium/cilium#47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](cilium/cilium#47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](cilium/cilium#48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](cilium/cilium#47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](cilium/cilium#47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](cilium/cilium#47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](cilium/cilium@705e964) (v1.20) ([#47949](cilium/cilium#47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](cilium/cilium@7caba52) (v1.20) ([#47864](cilium/cilium#47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](cilium/cilium#47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](cilium/cilium#47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](cilium/cilium#47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](cilium/cilium#47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](cilium/cilium#47962), Upstream PR [#47932](cilium/cilium#47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47587](cilium/cilium#47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47600](cilium/cilium#47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47646](cilium/cilium#47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47581](cilium/cilium#47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47446](cilium/cilium#47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47466](cilium/cilium#47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47758](cilium/cilium#47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47599](cilium/cilium#47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47607](cilium/cilium#47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46670](cilium/cilium#46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47606](cilium/cilium#47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47424](cilium/cilium#47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](cilium/cilium#47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](cilium/cilium#47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](cilium/cilium@dc2d74b) (v1.20) ([#47655](cilium/cilium#47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47750](cilium/cilium#47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](cilium/cilium#47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](cilium/cilium#47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](cilium/cilium#47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](cilium/cilium#47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.xcd.dev/gabrielcosi/home-ops/pulls/430

….20.1) (#349) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](cilium/cilium@1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](cilium/cilium#47615), Upstream PR [#47351](cilium/cilium#47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47148](cilium/cilium#47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47529](cilium/cilium#47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47449](cilium/cilium#47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47640](cilium/cilium#47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](cilium/cilium#47621), Upstream PR [#47343](cilium/cilium#47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47824](cilium/cilium#47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47838](cilium/cilium#47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47625](cilium/cilium#47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47880](cilium/cilium#47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47741](cilium/cilium#47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47583](cilium/cilium#47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47765](cilium/cilium#47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](cilium/cilium#47967), Upstream PR [#47802](cilium/cilium#47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47727](cilium/cilium#47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47295](cilium/cilium#47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47552](cilium/cilium#47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47593](cilium/cilium#47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47754](cilium/cilium#47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46842](cilium/cilium#46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47840](cilium/cilium#47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47766](cilium/cilium#47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46696](cilium/cilium#46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47457](cilium/cilium#47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47702](cilium/cilium#47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47627](cilium/cilium#47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47208](cilium/cilium#47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47579](cilium/cilium#47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47826](cilium/cilium#47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47890](cilium/cilium#47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47844](cilium/cilium#47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47791](cilium/cilium#47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47614](cilium/cilium#47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47535](cilium/cilium#47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47534](cilium/cilium#47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47792](cilium/cilium#47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47753](cilium/cilium#47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47470](cilium/cilium#47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47569](cilium/cilium#47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47743](cilium/cilium#47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47060](cilium/cilium#47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47608](cilium/cilium#47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47616](cilium/cilium#47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47364](cilium/cilium#47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47605](cilium/cilium#47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47771](cilium/cilium#47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47801](cilium/cilium#47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47691](cilium/cilium#47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47719](cilium/cilium#47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47703](cilium/cilium#47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47717](cilium/cilium#47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47724](cilium/cilium#47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47205](cilium/cilium#47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47780](cilium/cilium#47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47426](cilium/cilium#47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47725](cilium/cilium#47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47612](cilium/cilium#47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46116](cilium/cilium#46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47455](cilium/cilium#47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47762](cilium/cilium#47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47582](cilium/cilium#47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47592](cilium/cilium#47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47388](cilium/cilium#47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47841](cilium/cilium#47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](cilium/cilium#47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](cilium/cilium#48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](cilium/cilium#47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](cilium/cilium#47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](cilium/cilium#47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](cilium/cilium@705e964) (v1.20) ([#47949](cilium/cilium#47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](cilium/cilium@7caba52) (v1.20) ([#47864](cilium/cilium#47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](cilium/cilium#47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](cilium/cilium#47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](cilium/cilium#47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](cilium/cilium#47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](cilium/cilium#47962), Upstream PR [#47932](cilium/cilium#47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47587](cilium/cilium#47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47600](cilium/cilium#47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47646](cilium/cilium#47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47581](cilium/cilium#47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47446](cilium/cilium#47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47466](cilium/cilium#47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47758](cilium/cilium#47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47599](cilium/cilium#47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47607](cilium/cilium#47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46670](cilium/cilium#46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47606](cilium/cilium#47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47424](cilium/cilium#47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](cilium/cilium#47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](cilium/cilium#47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](cilium/cilium@dc2d74b) (v1.20) ([#47655](cilium/cilium#47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47750](cilium/cilium#47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](cilium/cilium#47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](cilium/cilium#47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](cilium/cilium#47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](cilium/cilium#47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/349

amaanx86 requested a review from a team as a code owner May 22, 2026 09:46

amaanx86 requested a review from hemanthmalla May 22, 2026 09:46

maintainer-s-little-helper Bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 22, 2026

github-actions Bot added the kind/community-contribution This was a contribution made by a community member. label May 22, 2026

xmulligan added the release-note/misc This PR makes changes that have no direct user impact. label May 26, 2026

aanm added the dont-merge/bad-bot To prevent MLH from marking ready-to-merge. label May 27, 2026

maintainer-s-little-helper Bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label May 27, 2026

aanm removed the dont-merge/bad-bot To prevent MLH from marking ready-to-merge. label May 27, 2026

This comment was marked as resolved.

Sign in to view

maintainer-s-little-helper Bot added the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Jun 1, 2026

amaanx86 force-pushed the oke-cni-chaining-doc branch from 3fafda0 to 13e657d Compare June 1, 2026 13:12

maintainer-s-little-helper Bot removed the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Jun 1, 2026

amaanx86 force-pushed the oke-cni-chaining-doc branch from 13e657d to b6c0dd6 Compare June 1, 2026 13:13

hemanthmalla requested a review from a team June 1, 2026 14:28

pchaigno added the area/documentation Impacts the documentation, including textual changes, sphinx, or other doc generation code. label Jun 2, 2026

pchaigno requested review from HadrienPatte and antonipp June 8, 2026 13:23

amaanx86 mentioned this pull request Jun 12, 2026

ladder: add amaanx86 as an org member cilium/community#416

Closed

3 tasks

github-actions Bot added the stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. label Jul 16, 2026

HadrienPatte removed the stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. label Jul 20, 2026

HadrienPatte approved these changes Jul 23, 2026

View reviewed changes

joestringer added the needs-backport/1.20 This PR / issue needs backporting to the v1.20 branch label Jul 28, 2026

amaanx86 added 5 commits July 29, 2026 01:42

docs: fix RST title underline length in OKE CNI chaining guide

ec0fbec

Signed-off-by: Amaan Ul Haq Siddiqui <[email protected]>

amaanx86 force-pushed the oke-cni-chaining-doc branch from de53622 to 72904e2 Compare July 28, 2026 20:43

joestringer enabled auto-merge July 28, 2026 20:49

joestringer approved these changes Jul 28, 2026

View reviewed changes

hemanthmalla approved these changes Jul 28, 2026

View reviewed changes

joestringer added this pull request to the merge queue Jul 29, 2026

Merged via the queue into cilium:main with commit 2128600 Jul 29, 2026
78 checks passed

viktor-kurchenko mentioned this pull request Aug 3, 2026

v1.20 Backports 2026-08-03 #47690

Merged

25 tasks

viktor-kurchenko added backport-pending/1.20 The backport for Cilium 1.20.x for this PR is in progress. and removed needs-backport/1.20 This PR / issue needs backporting to the v1.20 branch labels Aug 3, 2026

github-actions Bot added backport-done/1.20 The backport for Cilium 1.20.x for this PR is done. and removed backport-pending/1.20 The backport for Cilium 1.20.x for this PR is in progress. labels Aug 7, 2026

Uh oh!

Conversation

amaanx86 commented May 22, 2026

Checklist

Uh oh!

amaanx86 commented May 23, 2026

Uh oh!

amaanx86 commented May 25, 2026

Uh oh!

This comment was marked as resolved.

amaanx86 commented Jun 1, 2026

Uh oh!

hemanthmalla commented Jun 5, 2026

Uh oh!

HadrienPatte commented Jun 15, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

amaanx86 commented Jul 22, 2026

Uh oh!

HadrienPatte commented Jul 23, 2026

Uh oh!

HadrienPatte commented Jul 28, 2026

Uh oh!

joestringer commented Jul 28, 2026

Uh oh!

amaanx86 commented Jul 28, 2026

Uh oh!

joestringer commented Jul 28, 2026

Uh oh!

joestringer commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants