gateway-api: filter conflicted and invalid listeners before ingestion by asauber · Pull Request #47457 · cilium/cilium

asauber · 2026-07-24T08:20:20Z

Filter invalid and conflicted listeners before ingestion

Refactor resolveAllowedListeners into a collection of smaller functions which perform the following operations

Query for ListenerSets attached to a Gateway
Filter to the allowed ListenerSets for the Gateway
Merge a collection of direct and ListenerSet listeners
Filter out conflicted listeners from a set of listeners
Distinguish between same-source and cross-source conflicts
Filter out invalid Listeners using the existing validateListener

This allows us to compose calls that prevent both Gateway-direct listeners and ListenerSet listeners which conflict with each other from reaching the ingestion phase.

This handles both "same source" conflicts, where both listeners should be rejected, and "cross source" conflicts, where only the less precedent listener should be rejected.

Listener filtering using validateListener and test updates

Note that one of the most important things that this commit introduces is the use of r.validateListener to filter out invalid listeners before ingestion. This is a pre-existing validation function which was not yet used to prevent listeners from reaching ingestion. This filters out the following types of invalid listeners:

Listeners with unsupported protocols
Listeners with invalid route kinds
Listeners with invalid certificates
Listeners with invalid secret references

All of these cases previously had correct status-writing, but the listener objects were still allowed to reach the ingestion phase. This is no longer the case. The gateway-modify-listeners test case needed corrections after this more strict validation was implemented. The gateway-remove-listener Gateway correctly reported InvalidCertificateRef in status. However, the output CEC still contained the HTTPS filter chain. So, the CEC fixture was modified to remove the HTTPS filter chain.

A test case was added which confirms that both the resulting ListenerSet status and CEC correctly reflect a listener with a TLS/HTTPS protocol conflict.

Reuse listener conflicts for status writing

Use the existing conflict detection listener aggregation to drive status writing. This helps to match listener liveness with reported status.

Update fake client to always restore TypeMeta

Use an interceptor function to restore type meta for objects populated using the fake client. Do not populate type meta for CECs.

Remove all points in the Gateway API and GAMMA tests which manually restore the TypeMeta information for the fake client objects.

Fixes: #46917
Fixes: #47519

AIL:2

gateway-api: prevent conflicted listeners from reaching ingestion

asauber · 2026-07-24T08:28:18Z

/test

cilium-ariane · 2026-07-24T08:41:08Z

/test

mhofstetter · 2026-07-24T09:50:38Z

probably worth to merge #47430 first (both add changes in the same area)

cc @arybolovlev

(btw needs a rebase anyway @asauber )

asauber · 2026-07-24T10:23:07Z

/test

cilium-ariane · 2026-07-24T10:45:27Z

/test

Use an interceptor function to restore type meta for objects populated using the fake client. Do not populate type meta for CECs. Remove all points in the Gateway API and GAMMA tests which manually restore the TypeMeta information for the fake client objects. Signed-off-by: Andrew Sauber <[email protected]>

Refactor resolveAllowedListeners into a collection of smaller functions which perform the following operations. * Query for ListenerSets attached to a Gateway * Filter to the allowed ListenerSets for the Gateway * Merge a collection of direct and ListenerSet listeners * Filter out conflicted listeners from a set of listeners * Distinguish between same-source and cross-source conflicts * Filter out invalid Listeners using the existing validateListener This allows us to compose calls that prevent both Gateway-direct listeners and ListenerSet listeners which conflict with each other from reaching the ingestion phase. This handles both "same source" conflicts, where both listeners should be rejected, and "cross source" conflicts, where only the less precedent listener should be rejected. Note that one of the most important things that this commit introduces is the use of r.validateListener to filter out invalid listeners before ingestion. This is a pre-existing validation function which was not yet used to prevent listeners from reaching ingestion. This filters out the following types of invalid listeners: * Listeners with unsupported protocols * Listeners with invalid route kinds * Listeners with invalid certificates * Listeners with invalid secret references All of these cases previously had correct status-writing, but the listener objects were still allowed to reach the ingestion phase. This is no longer the case. The gateway-modify-listeners test case needed corrections after this more strict validation was implemented. The gateway-remove-listener Gateway correctly reported InvalidCertificateRef in status. However, the output CEC still contained the HTTPS filter chain. So, the CEC fixture was modified to remove the HTTPS filter chain. A test case was added which confirms that both the resulting ListenerSet status and CEC correctly reflect a listener with a TLS/HTTPS protocol conflict. Signed-off-by: Andrew Sauber <[email protected]>

Use the existing conflict detection listener aggregation to drive status writing. This helps to match listener liveness with reported status. Signed-off-by: Andrew Sauber <[email protected]>

asauber · 2026-07-27T09:10:46Z

After rebasing on top of #47430, it became clear that the scope of this PR needed to expand slightly. In order to properly filter a much wider set of invalid listener cases, we add a filter step which calls the pre-existing validateListener function.

This revealed some existing "bad fixtures", which required the general fix for the TypeMeta problem with fake client.

@youngnick please see the updated description for more details, sorry that it's a bit long

asauber · 2026-07-27T09:14:02Z

Ping @arybolovlev, since I removed listenerSupportedForIngestion here, and replaced it with the more general filterOutInvalidListeners here, which removes the duplicated L4 logic from your recent PR. You might be interested if you are working on anything related.

asauber · 2026-07-27T10:45:52Z

/test

….20.1) (#430) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](cilium/cilium@1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](cilium/cilium#47615), Upstream PR [#47351](cilium/cilium#47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47148](cilium/cilium#47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47529](cilium/cilium#47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47449](cilium/cilium#47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47640](cilium/cilium#47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](cilium/cilium#47621), Upstream PR [#47343](cilium/cilium#47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47824](cilium/cilium#47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47838](cilium/cilium#47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47625](cilium/cilium#47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47880](cilium/cilium#47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47741](cilium/cilium#47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47583](cilium/cilium#47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47765](cilium/cilium#47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](cilium/cilium#47967), Upstream PR [#47802](cilium/cilium#47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47727](cilium/cilium#47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47295](cilium/cilium#47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47552](cilium/cilium#47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47593](cilium/cilium#47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47754](cilium/cilium#47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46842](cilium/cilium#46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47840](cilium/cilium#47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47766](cilium/cilium#47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46696](cilium/cilium#46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47457](cilium/cilium#47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47702](cilium/cilium#47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47627](cilium/cilium#47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47208](cilium/cilium#47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47579](cilium/cilium#47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47826](cilium/cilium#47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47890](cilium/cilium#47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47844](cilium/cilium#47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47791](cilium/cilium#47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47614](cilium/cilium#47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47535](cilium/cilium#47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47534](cilium/cilium#47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47792](cilium/cilium#47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47753](cilium/cilium#47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47470](cilium/cilium#47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47569](cilium/cilium#47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47743](cilium/cilium#47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47060](cilium/cilium#47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47608](cilium/cilium#47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47616](cilium/cilium#47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47364](cilium/cilium#47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47605](cilium/cilium#47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47771](cilium/cilium#47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47801](cilium/cilium#47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47691](cilium/cilium#47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47719](cilium/cilium#47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47703](cilium/cilium#47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47717](cilium/cilium#47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47724](cilium/cilium#47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47205](cilium/cilium#47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47780](cilium/cilium#47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47426](cilium/cilium#47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47725](cilium/cilium#47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47612](cilium/cilium#47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46116](cilium/cilium#46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47455](cilium/cilium#47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47762](cilium/cilium#47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47582](cilium/cilium#47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47592](cilium/cilium#47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47388](cilium/cilium#47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47841](cilium/cilium#47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](cilium/cilium#47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](cilium/cilium#48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](cilium/cilium#47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](cilium/cilium#47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](cilium/cilium#47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](cilium/cilium@705e964) (v1.20) ([#47949](cilium/cilium#47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](cilium/cilium@7caba52) (v1.20) ([#47864](cilium/cilium#47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](cilium/cilium#47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](cilium/cilium#47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](cilium/cilium#47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](cilium/cilium#47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](cilium/cilium#47962), Upstream PR [#47932](cilium/cilium#47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47587](cilium/cilium#47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47600](cilium/cilium#47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47646](cilium/cilium#47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47581](cilium/cilium#47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47446](cilium/cilium#47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47466](cilium/cilium#47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47758](cilium/cilium#47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47599](cilium/cilium#47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47607](cilium/cilium#47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46670](cilium/cilium#46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47606](cilium/cilium#47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47424](cilium/cilium#47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](cilium/cilium#47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](cilium/cilium#47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](cilium/cilium@dc2d74b) (v1.20) ([#47655](cilium/cilium#47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47750](cilium/cilium#47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](cilium/cilium#47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](cilium/cilium#47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](cilium/cilium#47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](cilium/cilium#47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.xcd.dev/gabrielcosi/home-ops/pulls/430

….20.1) (#349) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](cilium/cilium@1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](cilium/cilium#47615), Upstream PR [#47351](cilium/cilium#47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47148](cilium/cilium#47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47529](cilium/cilium#47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47449](cilium/cilium#47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47640](cilium/cilium#47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](cilium/cilium#47621), Upstream PR [#47343](cilium/cilium#47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47824](cilium/cilium#47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47838](cilium/cilium#47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47625](cilium/cilium#47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47880](cilium/cilium#47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47741](cilium/cilium#47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47583](cilium/cilium#47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47765](cilium/cilium#47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](cilium/cilium#47967), Upstream PR [#47802](cilium/cilium#47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47727](cilium/cilium#47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47295](cilium/cilium#47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47552](cilium/cilium#47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47593](cilium/cilium#47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47754](cilium/cilium#47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46842](cilium/cilium#46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47840](cilium/cilium#47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47766](cilium/cilium#47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46696](cilium/cilium#46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47457](cilium/cilium#47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47702](cilium/cilium#47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47627](cilium/cilium#47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47208](cilium/cilium#47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47579](cilium/cilium#47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47826](cilium/cilium#47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47890](cilium/cilium#47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47844](cilium/cilium#47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47791](cilium/cilium#47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47614](cilium/cilium#47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47535](cilium/cilium#47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47534](cilium/cilium#47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47792](cilium/cilium#47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47753](cilium/cilium#47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47470](cilium/cilium#47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47569](cilium/cilium#47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47743](cilium/cilium#47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47060](cilium/cilium#47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47608](cilium/cilium#47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47616](cilium/cilium#47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47364](cilium/cilium#47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47605](cilium/cilium#47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47771](cilium/cilium#47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47801](cilium/cilium#47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47691](cilium/cilium#47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47719](cilium/cilium#47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47703](cilium/cilium#47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47717](cilium/cilium#47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47724](cilium/cilium#47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47205](cilium/cilium#47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47780](cilium/cilium#47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47426](cilium/cilium#47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47725](cilium/cilium#47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47612](cilium/cilium#47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46116](cilium/cilium#46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47455](cilium/cilium#47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47762](cilium/cilium#47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47582](cilium/cilium#47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47592](cilium/cilium#47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47388](cilium/cilium#47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47841](cilium/cilium#47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](cilium/cilium#47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](cilium/cilium#48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](cilium/cilium#47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](cilium/cilium#47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](cilium/cilium#47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](cilium/cilium@705e964) (v1.20) ([#47949](cilium/cilium#47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](cilium/cilium@7caba52) (v1.20) ([#47864](cilium/cilium#47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](cilium/cilium#47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](cilium/cilium#47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](cilium/cilium#47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](cilium/cilium#47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](cilium/cilium#47962), Upstream PR [#47932](cilium/cilium#47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47587](cilium/cilium#47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47600](cilium/cilium#47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47646](cilium/cilium#47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47581](cilium/cilium#47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47446](cilium/cilium#47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47466](cilium/cilium#47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47758](cilium/cilium#47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47599](cilium/cilium#47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47607](cilium/cilium#47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46670](cilium/cilium#46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47606](cilium/cilium#47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47424](cilium/cilium#47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](cilium/cilium#47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](cilium/cilium#47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](cilium/cilium@dc2d74b) (v1.20) ([#47655](cilium/cilium#47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47750](cilium/cilium#47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](cilium/cilium#47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](cilium/cilium#47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](cilium/cilium#47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](cilium/cilium#47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/349

maintainer-s-little-helper Bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 24, 2026

github-actions Bot added the feature/k8s-gateway-api label Jul 24, 2026

asauber added release-note/bug This PR fixes an issue in a previous release of Cilium. and removed feature/k8s-gateway-api labels Jul 24, 2026

maintainer-s-little-helper Bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 24, 2026

asauber added dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. feature/k8s-gateway-api labels Jul 24, 2026

maintainer-s-little-helper Bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 24, 2026

asauber self-assigned this Jul 24, 2026

asauber added area/operator Impacts the cilium-operator component area/agent Cilium agent related. area/servicemesh GH issues or PRs regarding servicemesh labels Jul 24, 2026

asauber marked this pull request as ready for review July 24, 2026 08:23

asauber requested a review from a team as a code owner July 24, 2026 08:23

asauber requested a review from youngnick July 24, 2026 08:23

asauber mentioned this pull request Jul 24, 2026

gateway-api: exclude conflicted listeners from translation #47306

Merged

8 tasks

asauber removed the area/agent Cilium agent related. label Jul 24, 2026

mhofstetter added the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Jul 24, 2026

asauber force-pushed the pr/asauber/conflicted-listeners-dont-reach-ingestion branch from 694574c to 6886c7d Compare July 24, 2026 10:22

asauber removed the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Jul 24, 2026

asauber mentioned this pull request Jul 24, 2026

gateway-api: rejected ProtocolConflict listeners still serve traffic #46917

Closed

3 tasks

asauber force-pushed the pr/asauber/conflicted-listeners-dont-reach-ingestion branch from 6886c7d to bea5912 Compare July 27, 2026 03:49

maintainer-s-little-helper Bot added the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Jul 27, 2026

asauber force-pushed the pr/asauber/conflicted-listeners-dont-reach-ingestion branch from 04bdc2f to 93706e3 Compare July 27, 2026 06:04

cilium deleted a comment from maintainer-s-little-helper Bot Jul 27, 2026

asauber force-pushed the pr/asauber/conflicted-listeners-dont-reach-ingestion branch from 93706e3 to c03b058 Compare July 27, 2026 07:44

maintainer-s-little-helper Bot removed the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Jul 27, 2026

asauber added 3 commits July 27, 2026 17:56

gateway-api: reuse listener conflicts for status writing

6c6c9df

Use the existing conflict detection listener aggregation to drive status writing. This helps to match listener liveness with reported status. Signed-off-by: Andrew Sauber <[email protected]>

asauber force-pushed the pr/asauber/conflicted-listeners-dont-reach-ingestion branch from c03b058 to 6c6c9df Compare July 27, 2026 09:03

asauber changed the title ~~gateway-api: filter conflicted listeners before ingestion~~ gateway-api: filter conflicted and invalid listeners before ingestion Jul 27, 2026

youngnick reviewed Jul 28, 2026

View reviewed changes

Comment thread ...estdata/gateway/listenerset-tls-protocol-conflict/output/tlsroute-tls-protocol-conflict.yaml

youngnick approved these changes Jul 28, 2026

View reviewed changes

maintainer-s-little-helper Bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jul 28, 2026

youngnick added this pull request to the merge queue Jul 28, 2026

Merged via the queue into cilium:main with commit 8176a93 Jul 28, 2026
79 checks passed

youngnick mentioned this pull request Jul 28, 2026

gateway-api: unify Gateway API listener parentRef matching #46670

Merged

mhofstetter added the needs-backport/1.20 This PR / issue needs backporting to the v1.20 branch label Jul 28, 2026

This was referenced Aug 3, 2026

Gateway API regression in v1.20.0: wildcard HTTPS listener conflicts with exact TLS passthrough listener on port 443 #47590

Closed

Graph-Driven Validation for Gateway API Reconciler #46681

Open

viktor-kurchenko mentioned this pull request Aug 3, 2026

v1.20 Backports 2026-08-03 #47690

Merged

25 tasks

viktor-kurchenko added backport-pending/1.20 The backport for Cilium 1.20.x for this PR is in progress. and removed needs-backport/1.20 This PR / issue needs backporting to the v1.20 branch labels Aug 3, 2026

github-actions Bot added backport-done/1.20 The backport for Cilium 1.20.x for this PR is done. and removed backport-pending/1.20 The backport for Cilium 1.20.x for this PR is in progress. labels Aug 7, 2026

asauber mentioned this pull request Aug 7, 2026

conformance: test that invalid listeners do not allow connections kubernetes-sigs/gateway-api#5147

Open

Navigation Menu

Uh oh!

gateway-api: filter conflicted and invalid listeners before ingestion - #47457

gateway-api: filter conflicted and invalid listeners before ingestion#47457
youngnick merged 3 commits into
cilium:mainfrom
asauber:pr/asauber/conflicted-listeners-dont-reach-ingestion

asauber commented Jul 24, 2026 •

edited

Loading

Uh oh!

asauber commented Jul 24, 2026

Uh oh!

cilium-ariane Bot commented Jul 24, 2026

Uh oh!

mhofstetter commented Jul 24, 2026 •

edited

Loading

Uh oh!

asauber commented Jul 24, 2026

Uh oh!

cilium-ariane Bot commented Jul 24, 2026

Uh oh!

asauber commented Jul 27, 2026 •

edited

Loading

Uh oh!

asauber commented Jul 27, 2026

Uh oh!

asauber commented Jul 27, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

asauber commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Filter invalid and conflicted listeners before ingestion

Listener filtering using validateListener and test updates

Reuse listener conflicts for status writing

Update fake client to always restore TypeMeta

Uh oh!

asauber commented Jul 24, 2026

Uh oh!

cilium-ariane Bot commented Jul 24, 2026

Uh oh!

mhofstetter commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

asauber commented Jul 24, 2026

Uh oh!

cilium-ariane Bot commented Jul 24, 2026

Uh oh!

asauber commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

asauber commented Jul 27, 2026

Uh oh!

asauber commented Jul 27, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

asauber commented Jul 24, 2026 •

edited

Loading

mhofstetter commented Jul 24, 2026 •

edited

Loading

asauber commented Jul 27, 2026 •

edited

Loading