ci: build race images on push events so conformance-race works on stable branches by aanm · Pull Request #47608 · cilium/cilium

aanm · 2026-07-30T12:05:36Z

conformance-race has never been green on a stable branch, and on main it has been green for the wrong reason. There are two independent bugs and they point in opposite directions, which is why this went unnoticed for so long.

The first one is why v1.19 and v1.20 are red. Commit 7329f8f stopped building the race images for merge_group and push events, back when the only consumer was a manual /ci-conformance-race trigger on a pull request. That is no longer true: ariane-scheduled.yaml dispatches conformance-race hourly against the branch tip of v1.19 and v1.20, and a branch tip gets its images from the push event. So cilium-ci:-race simply never exists, conformance-ginkgo's wait-for-images polls for it until it hits its 30 minute timeout, the job ends up cancelled, every E2E leg is skipped and the status gate reports failure. I verified this against quay: pull request heads targeting v1.20 have the -race tag for cilium-ci, operator-generic-ci and hubble-relay-ci, while the branch tips only have the plain tag.

The second one is worse, because it is a false green. prepare-extra-args in conformance-race.yaml pipes inputs.extra-args into jq, but on schedule events that input is unset, so jq reads an empty stdin, emits nothing at all, and the job output becomes the empty string instead of {"detect-race":true}. conformance-ginkgo then computes detect-race as false, appends no -race suffix and runs the plain images. The nightly run on main has been passing while quietly testing without the race detector. Run 30503093093 shows it plainly: -cilium.tag= carries no -race suffix.

That asymmetry is what hid both bugs. On main the nightly comes from conformance-race.yaml's own cron, so the second bug masks the first one by making the workflow wait for plain images, which do exist. The stable branches are dispatched by ariane as workflow_dispatch with real extra-args, so detect-race really is true there and they run head first into the missing images.

So the fix is to build race images on push while keeping them out of the merge queue, where nothing consumes them and the cost would be paid on every single merge, and to default the jq input to an empty object. The unstripped images stay disabled for both events since no workflow consumes them at all.

Both fixes are proven by two runs on this branch. Neither of them can be reproduced through a pull request, because for pull_request_target GitHub reads the workflow definition from the base branch, so the push path has to be exercised on a branch that actually receives a push. I did that with two temporary commits that added this branch to the push triggers, and have since dropped them.

Run 30541045892 proves both bugs are fixed. prepare-extra-args emitted extra-args: {"detect-race":true} with no inputs at all, which is exactly the empty extra-args path the nightly schedule takes and which previously produced the empty string. Setup Vars then consumed it and set the -race image tag suffix. Wait for images completed successfully, which is the very job that burns its full 30 minute timeout on every stable branch dispatch today, and the E2E legs went on to run against the race images. Run 30541045451 is the corresponding Image CI Build, where the CI race detection Build steps ran instead of being skipped and published cilium-ci, operator-generic-ci, hubble-relay-ci and cilium-cli-ci with the -race tag from a push event.

Run 30542016821 then ran the full matrix rather than the single focus that detect-race normally restricts it to, so that we would know whether race detection is actually clean before this reaches main. 24 of 25 legs passed with no data races reported anywhere. The one failure, E2E Test (1.35, f18-datapath-lrp), is unrelated to race detection: the spec body passed and the AfterEach log check tripped over a benign leader election read timeout in the operator, which the same focus on 1.36 did not hit. That is fixed separately in #47612.

Worth flagging for whoever reviews this: fixing the second bug turns the nightly on main into a real race detection run for the first time. The full matrix came back clean here, but it is now a check that can genuinely fail.

On cost, the race build adds roughly two to six minutes per matrix leg, with the cilium image itself at 371 seconds. Push runs of Image CI currently finish in about ten minutes against a 45 minute job timeout, so there is plenty of headroom.

v1.17 and v1.18 do not need this. Neither branch ships conformance-race.yaml nor references it from ariane-config.yaml, so there is no consumer of the race images there.

This PR was prepared with AIL:3.

aanm · 2026-07-30T12:07:00Z

/test

cilium-ariane · 2026-07-30T12:39:46Z

/test

Commit 7329f8f stopped building the race and unstripped CI images for merge_group and push events, back when race images were only ever used by a manual /ci-conformance-race trigger on a pull request. That is no longer true. conformance-race.yaml runs on a nightly schedule, and ariane-scheduled.yaml dispatches it hourly against v1.19 and v1.20. Both of those run against a branch tip, whose images come from the push event, so cilium-ci:<sha>-race never exists and conformance-ginkgo's wait-for-images job polls for it until it hits its 30 minute timeout. The whole workflow is then cancelled without running a single test, which is why conformance-race has never been green on a stable branch. Keep race images out of the merge queue, where nothing consumes them and the extra build time is paid on every merge, but build them on push so that the scheduled race detection runs have images to test with. The unstripped images stay disabled for both events since no workflow consumes them. This commit was prepared with AIL:3. Fixes: 7329f8f ("ci: build race and unstripped images only in PRs") Signed-off-by: André Martins <[email protected]>

inputs.extra-args is unset on schedule events, so ARGS ends up empty and jq reads an empty stdin, produces no output at all and the extra-args job output becomes the empty string instead of {"detect-race":true}. conformance-ginkgo then computes detect-race as false, appends no -race suffix to the image tag and runs the plain images, so the nightly race detection run has been quietly testing without the race detector while still reporting success. Default ARGS to an empty JSON object so the merge always yields an object. This commit was prepared with AIL:3. Fixes: 4261328 ("ci: add conformance-race") Signed-off-by: André Martins <[email protected]>

aanm · 2026-07-30T13:15:02Z

/test

cilium-ariane · 2026-07-30T13:33:21Z

/test

….20.1) (#430) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](cilium/cilium@1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](cilium/cilium#47615), Upstream PR [#47351](cilium/cilium#47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47148](cilium/cilium#47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47529](cilium/cilium#47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47449](cilium/cilium#47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47640](cilium/cilium#47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](cilium/cilium#47621), Upstream PR [#47343](cilium/cilium#47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47824](cilium/cilium#47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47838](cilium/cilium#47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47625](cilium/cilium#47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47880](cilium/cilium#47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47741](cilium/cilium#47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47583](cilium/cilium#47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47765](cilium/cilium#47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](cilium/cilium#47967), Upstream PR [#47802](cilium/cilium#47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47727](cilium/cilium#47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47295](cilium/cilium#47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47552](cilium/cilium#47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47593](cilium/cilium#47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47754](cilium/cilium#47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46842](cilium/cilium#46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47840](cilium/cilium#47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47766](cilium/cilium#47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46696](cilium/cilium#46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47457](cilium/cilium#47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47702](cilium/cilium#47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47627](cilium/cilium#47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47208](cilium/cilium#47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47579](cilium/cilium#47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47826](cilium/cilium#47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47890](cilium/cilium#47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47844](cilium/cilium#47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47791](cilium/cilium#47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47614](cilium/cilium#47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47535](cilium/cilium#47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47534](cilium/cilium#47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47792](cilium/cilium#47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47753](cilium/cilium#47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47470](cilium/cilium#47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47569](cilium/cilium#47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47743](cilium/cilium#47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47060](cilium/cilium#47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47608](cilium/cilium#47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47616](cilium/cilium#47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47364](cilium/cilium#47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47605](cilium/cilium#47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47771](cilium/cilium#47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47801](cilium/cilium#47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47691](cilium/cilium#47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47719](cilium/cilium#47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47703](cilium/cilium#47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47717](cilium/cilium#47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47724](cilium/cilium#47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47205](cilium/cilium#47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47780](cilium/cilium#47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47426](cilium/cilium#47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47725](cilium/cilium#47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47612](cilium/cilium#47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46116](cilium/cilium#46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47455](cilium/cilium#47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47762](cilium/cilium#47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47582](cilium/cilium#47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47592](cilium/cilium#47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47388](cilium/cilium#47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47841](cilium/cilium#47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](cilium/cilium#47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](cilium/cilium#48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](cilium/cilium#47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](cilium/cilium#47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](cilium/cilium#47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](cilium/cilium@705e964) (v1.20) ([#47949](cilium/cilium#47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](cilium/cilium@7caba52) (v1.20) ([#47864](cilium/cilium#47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](cilium/cilium#47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](cilium/cilium#47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](cilium/cilium#47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](cilium/cilium#47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](cilium/cilium#47962), Upstream PR [#47932](cilium/cilium#47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47587](cilium/cilium#47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47600](cilium/cilium#47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47646](cilium/cilium#47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47581](cilium/cilium#47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47446](cilium/cilium#47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47466](cilium/cilium#47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47758](cilium/cilium#47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47599](cilium/cilium#47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47607](cilium/cilium#47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46670](cilium/cilium#46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47606](cilium/cilium#47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47424](cilium/cilium#47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](cilium/cilium#47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](cilium/cilium#47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](cilium/cilium@dc2d74b) (v1.20) ([#47655](cilium/cilium#47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47750](cilium/cilium#47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](cilium/cilium#47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](cilium/cilium#47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](cilium/cilium#47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](cilium/cilium#47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.xcd.dev/gabrielcosi/home-ops/pulls/430

….20.1) (#349) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/cilium/charts/cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` → `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (quay.io/cilium/charts/cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](cilium/cilium@1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](cilium/cilium#47615), Upstream PR [#47351](cilium/cilium#47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47148](cilium/cilium#47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47529](cilium/cilium#47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47449](cilium/cilium#47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47640](cilium/cilium#47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](cilium/cilium#47621), Upstream PR [#47343](cilium/cilium#47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47824](cilium/cilium#47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47838](cilium/cilium#47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47625](cilium/cilium#47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47880](cilium/cilium#47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47741](cilium/cilium#47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47583](cilium/cilium#47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47765](cilium/cilium#47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](cilium/cilium#47967), Upstream PR [#47802](cilium/cilium#47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47727](cilium/cilium#47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47295](cilium/cilium#47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47552](cilium/cilium#47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47593](cilium/cilium#47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47754](cilium/cilium#47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46842](cilium/cilium#46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47840](cilium/cilium#47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47766](cilium/cilium#47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46696](cilium/cilium#46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47457](cilium/cilium#47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47702](cilium/cilium#47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47627](cilium/cilium#47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47208](cilium/cilium#47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47579](cilium/cilium#47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47826](cilium/cilium#47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47890](cilium/cilium#47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47844](cilium/cilium#47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47791](cilium/cilium#47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47614](cilium/cilium#47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47535](cilium/cilium#47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47534](cilium/cilium#47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47792](cilium/cilium#47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47753](cilium/cilium#47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47470](cilium/cilium#47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47569](cilium/cilium#47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47743](cilium/cilium#47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47060](cilium/cilium#47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47608](cilium/cilium#47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](cilium/cilium#47609), Upstream PR [#47616](cilium/cilium#47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47364](cilium/cilium#47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47605](cilium/cilium#47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47771](cilium/cilium#47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47801](cilium/cilium#47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47691](cilium/cilium#47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47719](cilium/cilium#47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47703](cilium/cilium#47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47717](cilium/cilium#47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](cilium/cilium#47731), Upstream PR [#47724](cilium/cilium#47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47205](cilium/cilium#47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47780](cilium/cilium#47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](cilium/cilium#47954), Upstream PR [#47426](cilium/cilium#47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47725](cilium/cilium#47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47612](cilium/cilium#47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46116](cilium/cilium#46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47455](cilium/cilium#47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47762](cilium/cilium#47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47582](cilium/cilium#47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47592](cilium/cilium#47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47388](cilium/cilium#47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](cilium/cilium#47881), Upstream PR [#47841](cilium/cilium#47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](cilium/cilium#47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](cilium/cilium#48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](cilium/cilium#47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](cilium/cilium#47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](cilium/cilium#47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](cilium/cilium@705e964) (v1.20) ([#47949](cilium/cilium#47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](cilium/cilium@7caba52) (v1.20) ([#47864](cilium/cilium#47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](cilium/cilium#47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](cilium/cilium#47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](cilium/cilium#47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](cilium/cilium#47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](cilium/cilium#47962), Upstream PR [#47932](cilium/cilium#47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47587](cilium/cilium#47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47600](cilium/cilium#47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47646](cilium/cilium#47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47581](cilium/cilium#47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47446](cilium/cilium#47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47466](cilium/cilium#47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](cilium/cilium#47885), Upstream PR [#47758](cilium/cilium#47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47599](cilium/cilium#47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47607](cilium/cilium#47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#46670](cilium/cilium#46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](cilium/cilium#47805), Upstream PR [#47606](cilium/cilium#47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](cilium/cilium#47690), Upstream PR [#47424](cilium/cilium#47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](cilium/cilium#47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](cilium/cilium#47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](cilium/cilium@dc2d74b) (v1.20) ([#47655](cilium/cilium#47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](cilium/cilium#47798), Upstream PR [#47750](cilium/cilium#47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](cilium/cilium#47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](cilium/cilium#47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](cilium/cilium#47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](cilium/cilium#47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/349

maintainer-s-little-helper Bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 30, 2026

This was referenced Jul 30, 2026

[v1.20] ci: build race images on push events #47609

Merged

[v1.19] ci: build race images on push events #47610

Merged

aanm added backport-pending/1.19 The backport for Cilium 1.19.x for this PR is in progress. backport-pending/1.20 The backport for Cilium 1.20.x for this PR is in progress. kind/bug/CI This is a bug in the testing code. release-note/ci This PR makes changes to the CI. labels Jul 30, 2026

maintainer-s-little-helper Bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 30, 2026

aanm added the backport/author The backport will be carried out by the author of the PR. label Jul 30, 2026

aanm added 2 commits July 30, 2026 15:12

aanm force-pushed the pr/aanm/build-race-images-on-push branch from 539305c to 4a265b2 Compare July 30, 2026 13:12

aanm marked this pull request as ready for review July 30, 2026 13:15

aanm requested review from a team as code owners July 30, 2026 13:15

aanm requested a review from Artyop July 30, 2026 13:15

aanm enabled auto-merge July 30, 2026 13:15

Artyop approved these changes Jul 30, 2026

View reviewed changes

aanm added this pull request to the merge queue Jul 30, 2026

maintainer-s-little-helper Bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jul 30, 2026

Merged via the queue into main with commit a6687e1 Jul 30, 2026
102 checks passed

aanm deleted the pr/aanm/build-race-images-on-push branch July 30, 2026 16:07

This was referenced Jul 30, 2026

ci: build race images on push in the stable image builders #47616

Merged

[v1.18] ci: build race images on push events #47618

Merged

github-actions Bot removed the backport-pending/1.19 The backport for Cilium 1.19.x for this PR is in progress. label Jul 31, 2026

github-actions Bot added backport-done/1.19 The backport for Cilium 1.19.x for this PR is done. backport-done/1.20 The backport for Cilium 1.20.x for this PR is done. and removed backport-pending/1.20 The backport for Cilium 1.20.x for this PR is in progress. labels Jul 31, 2026

Navigation Menu

Uh oh!

ci: build race images on push events so conformance-race works on stable branches - #47608

ci: build race images on push events so conformance-race works on stable branches#47608
aanm merged 2 commits into
mainfrom
pr/aanm/build-race-images-on-push

aanm commented Jul 30, 2026 •

edited

Loading

Uh oh!

aanm commented Jul 30, 2026

Uh oh!

cilium-ariane Bot commented Jul 30, 2026

Uh oh!

aanm commented Jul 30, 2026

Uh oh!

cilium-ariane Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

aanm commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aanm commented Jul 30, 2026

Uh oh!

cilium-ariane Bot commented Jul 30, 2026

Uh oh!

aanm commented Jul 30, 2026

Uh oh!

cilium-ariane Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aanm commented Jul 30, 2026 •

edited

Loading