fix(helm): update cilium group (patch) by renovate[bot] · Pull Request #2991 · mglants/gitops

renovate · 2026-06-16T19:18:25Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	HelmChart	patch	`1.18.10` → `1.18.14`
cilium (source)	HelmChart	patch	`1.18.13` → `1.18.14`
cilium (source)		patch	`1.18.10` → `1.18.14`
cilium (source)		patch	`1.18.13` → `1.18.14`
quay.io/cilium/cilium		patch	`v1.18.10` → `v1.18.14`
quay.io/cilium/hubble-relay		patch	`v1.18.10` → `v1.18.14`
quay.io/cilium/hubble-ui		patch	`v0.13.5` → `v0.13.6`
quay.io/cilium/hubble-ui-backend		patch	`v0.13.5` → `v0.13.6`
quay.io/cilium/operator-generic		patch	`v1.18.10` → `v1.18.14`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

`v1.18.14`: 1.18.14

Compare Source

Summary of Changes

Bugfixes:

aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48607, Upstream PR #48193, @41ks)
bpf: Fix agent crash when dumping map events (Backport PR #48380, Upstream PR #48273, @joestringer)
datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48554, Upstream PR #46861, @fdomain)
Fix Hubble Relay remains running during termination (Backport PR #48554, Upstream PR #47942, @xandau)
Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48554, Upstream PR #48391, @fristonio)
Fix nodeport egress tuple reuse for closed connections (Backport PR #48406, Upstream PR #48306, @fristonio)
Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48423, @fristonio)
fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR #48554, Upstream PR #44066, @puwun)
Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48216, Upstream PR #47915, @giorio94)
Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48432, Upstream PR #47635, @aanm)
hubble: fix four config knobs that never reach their sink (Backport PR #48432, Upstream PR #47637, @aanm)
operator: Emit startup logs in the configured log format (Backport PR #48019, Upstream PR #47890, @HadrienPatte)
Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48216, Upstream PR #48015, @giorio94)

CI Changes:

.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48554, Upstream PR #48462, @joestringer)
ci: replace unsupported LLVM installation action (Backport PR #48406, Upstream PR #47776, @bogdankrasko)
ci: resolve renovate PR metadata in base image workflows (Backport PR #48216, Upstream PR #47964, @mhofstetter)
ci: use GitHub App client ID in v1.18 image workflow (Backport PR #48216, Upstream PR #47785, @bogdankrasko)
Further GC ratchet test fix races (Backport PR #48019, Upstream PR #43075, @tommyp1ckles)
gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48554, Upstream PR #48545, @aanm)
gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48554, Upstream PR #48481, @aanm)
gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48216, Upstream PR #48048, @aanm)
gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48216, Upstream PR #48069, @aanm)
gha: compute the ginkgo cache key once, before the matrix (Backport PR #48216, Upstream PR #48127, @aanm)
gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48406, Upstream PR #48352, @aanm)
gha: publish the external target hostnames as FQDNs (Backport PR #48554, Upstream PR #48478, @aanm)
gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48432, Upstream PR #48203, @aanm)
Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48659, Upstream PR #48250, @giorio94)
Revert 48443 - disable local accounts on AKS clusters (#48526, @aanm)
test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48406, Upstream PR #48365, @aanm)
test: fix the never-taken retry on a partially read JSON line (Backport PR #48632, Upstream PR #48190, @aanm)
workflows: disable local accounts on AKS clusters (#48443, @nbusseneau)

Misc Changes:

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48632, Upstream PR #48421, @0xch4z)
bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48295, Upstream PR #46232, @julianwiedmann)
chore(deps): update all external docker images dependencies to v0.13.6 (v1.18) (#48683, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#48161, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#48337, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#48512, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#48685, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#48157, @cilium-renovate[bot])
chore(deps): update base-images to v1.26.8 (v1.18) (#48734, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.18) (#48346, @cilium-renovate[bot])
chore(deps): update dependency go to v1.25.14 (v1.18) (#48209, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.18) (#48338, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.18) (#48511, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang docker tag to v1.25.14 (v1.18) (#48158, @cilium-renovate[bot])
chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 224a186 (v1.18) (#48682, @cilium-renovate[bot])
chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.18) (#48519, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to e2e927e (v1.18) (#48700, @cilium-renovate[bot])
chore(deps): update golangci/golangci-lint docker tag to v2.13.1 (v1.18) (#48336, @cilium-renovate[bot])
chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.18) (#48733, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.0 (v1.18) (#48593, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.18) (#48159, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.10-1787983435-8f34575affde33ad364d1e669b953993bf1f4125 (v1.18) (#48334, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.18) (#48453, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.18) (#48684, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#48160, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#48335, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#48510, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#48515, @cilium-renovate[bot])
docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48632, Upstream PR #48487, @ekoops)
docs: Remove v1.18 ipsec documentation (Backport PR #48406, Upstream PR #48224, @joestringer)
Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48554, Upstream PR #48428, @marcus-chae)
Documentation: document mesh security model (Backport PR #48217, Upstream PR #47912, @bimmlerd)
Fix Component Overview doc link rendering (Backport PR #48632, Upstream PR #48537, @eneiss)
fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.18) (#48389, @cilium-renovate[bot])
fix(deps): update module google.golang.org/grpc to v1.83.2 [security] (v1.18) (#48576, @cilium-renovate[bot])
Fixed broken Slack link on Community page. (Backport PR #48406, Upstream PR #48021, @ps-mir)
Fixes: Update node-cache image version to 1.26.5 (Backport PR #48632, Upstream PR #48270, @zyue110026)
gha: authenticate release images with OIDC (Backport PR #48597, Upstream PR #48062, @aanm)
gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48058, Upstream PR #48061, @aanm)
gha: correct and move the OIDC subject comments (Backport PR #48058, Upstream PR #48370, @aanm)
gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48597, Upstream PR #48535, @aanm)
helm: add general busybox image values for substitution (Backport PR #48406, Upstream PR #47973, @0xch4z)

Other Changes:

[v1.18] cilium: revert have_set_retval fix and probe it differently, v2 (#48405, @borkmann)
[v1.18] proxy: Bump envoy to v1.37.x (#48312, @sayboras)
Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing (#48381, @borkmann)
install: Update image digests for v1.18.13 (#48038, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.14@sha256:0e65a0910d74be4d56ebc8f8a010b566f9177444667dbb8eb5b2d8d840ea5406

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.14@sha256:fc776419ff39e6f384fbddb0db1c603458601277225b3ae6b609219214ad1255

docker-plugin

quay.io/cilium/docker-plugin:v1.18.14@sha256:75277ec46be1543ca62ff5ee998b5681420fcd01f855f27d4f3288802264f343

hubble-relay

quay.io/cilium/hubble-relay:v1.18.14@sha256:828c22fcde4c0f7317ad5bb0f73c42294c6b3e2be286bb9374cf66cea930fb5d

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.14@sha256:6790a4c3cd39412e02563534e7ab42cc211d14ea74e997b8cddd14425c709291

operator-aws

quay.io/cilium/operator-aws:v1.18.14@sha256:ba1996d44f0c17cdd03ba903f874b97f543314673c5af980fb1af3313ea542ac

operator-azure

quay.io/cilium/operator-azure:v1.18.14@sha256:38e802744945d9861b74cd9812250d5dbc2d6a4a24d08571b45cae71418b1c71

operator-generic

quay.io/cilium/operator-generic:v1.18.14@sha256:6a77082c3938edad0433f53c46a90b8da08c9e4a9a255e51a1c2ff410db60104

operator

quay.io/cilium/operator:v1.18.14@sha256:5709d0b8c44f23a528b90833444159eaed8a5f757ec07530fc5f693c3f969ecc

`v1.18.13`: 1.18.13

Compare Source

Summary of Changes

Major Changes:

Add support for VRRP and IGMP protocols in host firewall (Backport PR #47619, Upstream PR #39872, @aditighag)

Bugfixes:

bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47619, Upstream PR #47343, @smagnani96)
Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47687, Upstream PR #47552, @haozhangami)
Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #47799, Upstream PR #46967, @ysksuzuki)
ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47887, Upstream PR #47208, @iwanhae)

CI Changes:

.github: retry CLI and binary downloads over transient network errors (Backport PR #47289, Upstream PR #47167, @aanm)
bpf: test: improve network policy testing (Backport PR #47619, Upstream PR #41906, @julianwiedmann)
bpf: tests: IGMP improvements (Backport PR #47619, Upstream PR #43684, @julianwiedmann)
chore: use GH_RUNNER_CILIUM_BASE_AMD64/ARM64 vars for integration-test runners (Backport PR #47547, Upstream PR #47182, @bogdankrasko)
ci: build race images on push in the stable image builders (Backport PR #47618, Upstream PR #47616, @aanm)
ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47803, Upstream PR #47364, @mhofstetter)
ci: fix three renovate-PR CI flakes (kubectl download retry, merge-upload ref, EKS pool zones) (Backport PR #47540, Upstream PR #47357, @aanm)
CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (Backport PR #47289, Upstream PR #46860, @aanm)
ci: migrate set-commit-status to cilium/actions (Backport PR #47803, Upstream PR #47771, @bogdankrasko)
ci: skip etcd log fetch when kvstore was never started (Backport PR #47887, Upstream PR #47801, @aanm)
Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR #47289, Upstream PR #46985, @aanm)
conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR #47289, Upstream PR #47269, @aanm)
Decrease CI costs on AWS (Backport PR #47289, Upstream PR #46615, @aanm)
gha/e2e: cover etcd behind a service (Backport PR #47411, Upstream PR #47235, @giorio94)
gha/kubespray: run on schedule, rather than on every push (Backport PR #47735, Upstream PR #47719, @giorio94)
gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47735, Upstream PR #47703, @giorio94)
gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47735, Upstream PR #47717, @giorio94)
gha: stop scheduled runs emitting spurious artifact warnings (Backport PR #47289, Upstream PR #46989, @aanm)
images/scripts: Validate Envoy image vars against sed injection (Backport PR #47803, Upstream PR #47205, @MasloMaslane)
Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR #47289, Upstream PR #46882, @aanm)
pkg/rate: fix TestMaxParallelRequests flake under CI load (Backport PR #47289, Upstream PR #46856, @aanm)
Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #47887, Upstream PR #47780, @giorio94)
test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (Backport PR #47289, Upstream PR #46980, @aanm)
test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47803, Upstream PR #47725, @aanm)

Misc Changes:

allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47687, Upstream PR #47455, @giorio94)
bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #47557, Upstream PR #47021, @pchaigno)
bugtool: collect snmp6 and dev_snmp6 for IPv6 host packet drops (Backport PR #47411, Upstream PR #47353, @aanm)
chore(deps): update all github action dependencies (v1.18) (#47329, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#47494, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#47522, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#47871, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#47493, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.18) (#47341, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.18) (#47578, @cilium-renovate[bot])
chore(deps): update dependency go to v1.25.13 (v1.18) (#48004, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.18) (#47994, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang docker tag to v1.25.13 (v1.18) (#47951, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.12 docker digest to 2c7ebca (v1.18) (#47869, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.12 docker digest to d2e20dc (v1.18) (#47325, @cilium-renovate[bot])
chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 561618e (v1.18) (#47870, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (v1.18) (#47326, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v577 (v1.18) (#47512, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.18) (#47327, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.18) (#47491, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.18) (#48001, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#47328, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#47492, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#47872, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#47995, @cilium-renovate[bot])
docs/clustermesh: remove obsolete reference to service cache (Backport PR #47411, Upstream PR #47195, @giorio94)
docs: Fix DOCS_BUILDER_REPO env variable for BSD sed compatibility (Backport PR #47830, Upstream PR #46033, @arybolovlev)
docs: Update docs-builder for Makefile usage (Backport PR #47830, Upstream PR #45774, @joestringer)
fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (v1.18) (#47434, @cilium-renovate[bot])
Fixed the conformance-ginkgo feature status report not being uploaded as an artifact. (Backport PR #47540, Upstream PR #47174, @aanm)
gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR #47289, Upstream PR #47140, @aanm)
gha: let auto-approve match on re-runs (Backport PR #47289, Upstream PR #46832, @aanm)
policy/k8s: record processing start time for k8s NetworkPolicy updates (Backport PR #47289, Upstream PR #46979, @aanm)
Update all github action dependencies (v1.18) (#47670, @cilium-renovate[bot])
Update docker.io/library/busybox:1.37.0 Docker digest to 9db7b59 (v1.18) (#47664, @cilium-renovate[bot])
Update documentation dependencies (Backport PR #47830, Upstream PR #47750, @joestringer)
Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.18) (#47665, @cilium-renovate[bot])

Other Changes:

[v1.18] Add DNS request checking prior to qname extraction (#47385, @ferozsalam)
install: Update image digests for v1.18.12 (#47251, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.13@sha256:6e6e6a82a6a2a6d0bfe6dd7e36cb0222fa48135ad139ddc979b5c3c841e2db1a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.13@sha256:15891681a6c7e743a6180a132bd70eb66ba9d9097e66cd6630fd22b73bcceb9d

docker-plugin

quay.io/cilium/docker-plugin:v1.18.13@sha256:6420c3a70b3adaad0d18698d1653b4505fc40263507e8a6bf13727e4d1477252

hubble-relay

quay.io/cilium/hubble-relay:v1.18.13@sha256:039c374b59cf4be4ecee1b3e1ec11316180a82c1eb33a55b4ee00a0da4999ad3

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.13@sha256:b5604ded38c0b0d758d3b11013f4ed0f21a59b3a1535e6232b2b6a98904a93fa

operator-aws

quay.io/cilium/operator-aws:v1.18.13@sha256:bc24b51a0d3af69fead1693e853a0466118b236cc0a098f3c1fa6c6c4b307fc8

operator-azure

quay.io/cilium/operator-azure:v1.18.13@sha256:c0e9fddeb9080bc3e403b4ed25d216961807fecfe9f643afb514a09268966350

operator-generic

quay.io/cilium/operator-generic:v1.18.13@sha256:2041417ad2ebd8b3e7d80b63dd81810d405fa29f12926ddbe78321a74781993b

operator

quay.io/cilium/operator:v1.18.13@sha256:fc72348ee2d5818a432901795fd77dbf35c1a8887db72d73546b9ee404551725

`v1.18.12`: 1.18.12

Compare Source

Summary of Changes

Minor Changes:

gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #47016, Upstream PR #46403, @arybolovlev)

Bugfixes:

Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47003, Upstream PR #46821, @fristonio)
Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #47196, Upstream PR #46444, @giorio94)
gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #46838, Upstream PR #46350, @xtineskim)
ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47196, Upstream PR #46867, @pippolo84)

CI Changes:

.github: Generate CI binaries with correct module version (Backport PR #47098, Upstream PR #46742, @joestringer)
chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #46921, Upstream PR #46840, @sekhar-isovalent)

Misc Changes:

.github: allow fork PR checkout with actions/checkout v7 (Backport PR #47136, Upstream PR #47133, @aanm)
[v1.18] - .github/workflows: unpin cilium/cilium self-references to track main (#46612, @aanm)
chore(deps): update all github action dependencies (v1.18) (#46912, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#47111, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#46909, @cilium-renovate[bot])
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.18) (#47125, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#46776, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.12 (v1.18) (#46983, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.18) (#46727, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.22.5 (v1.18) (#46775, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.18) (#46659, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to f188e8c (v1.18) (#46910, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.12 docker digest to d7912ce (v1.18) (#47110, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to d29e660 (v1.18) (#47040, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.18) (#47041, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.18) (#46701, @cilium-renovate[bot])
chore: BYOCNI loopback for cilium (Backport PR #46706, Upstream PR #46646, @sekhar-isovalent)
chore: optimize building gops and cni/loopback (Backport PR #46846, Upstream PR #46781, @sekhar-isovalent)
ci: always set fail-fast to false on image builds (Backport PR #47196, Upstream PR #47064, @aanm)
docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #47196, Upstream PR #47026, @maksymbilokur-cisco)
docs: fix note about ipv4-native-routing-cidr default value (Backport PR #46794, Upstream PR #46603, @rptaylor)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46794, Upstream PR #46388, @tommyp1ckles)
fix(deps): update k8s.io/utils digest to be93311 (v1.18) (#46911, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to cf1189d (v1.18) (#47116, @cilium-renovate[bot])
gateway-api: return model from Gateway API ingestion (Backport PR #47016, Upstream PR #46450, @arybolovlev)
gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #47196, Upstream PR #47085, @aanm)
images ci: free preinstalled toolchains on tight runners before building (Backport PR #47196, Upstream PR #47141, @aanm)
images: Only build gops for the relevant platform (Backport PR #46706, Upstream PR #41160, @HadrienPatte)
Makefile: Generate full Cilium version in worktree (Backport PR #46794, Upstream PR #46737, @joestringer)

Other Changes:

install: Update image digests for v1.18.11 (#46592, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.12@sha256:94149589d9b77fe3a78f900121b36fab51b1ede0c4190924e2328facc37de210

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.12@sha256:29ae8a306bfa644b5a5e305a50dc54d7461ae173a3361d1b1ab6c2aade346a71

docker-plugin

quay.io/cilium/docker-plugin:v1.18.12@sha256:cf931f0713ba15696553b71e4aae719747a6f137631e41760f5b0ac83ebd5b58

hubble-relay

quay.io/cilium/hubble-relay:v1.18.12@sha256:308b186791faf8a8a9322ce64d2e12f66fa82a3f4659e7a79b31829b6195df61

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.12@sha256:c2b3ed511cd5193f51888cc36ec699151685d92b28c9bcd975ec1c1011653f37

operator-aws

quay.io/cilium/operator-aws:v1.18.12@sha256:da54cc50e76e6439205c2816b29a791c09584de5f60a39ae2821d471eabe78f8

operator-azure

quay.io/cilium/operator-azure:v1.18.12@sha256:b435e3e41629ffea2687e58c7be6dfb29b4862ca0b517990ae40fe1effb36044

operator-generic

quay.io/cilium/operator-generic:v1.18.12@sha256:86899c73438812b2761ac6fa435ea4e65f68e70d1ae54ac806fec8805d1ce011

operator

quay.io/cilium/operator:v1.18.12@sha256:2ad7a424177b025f011d60fa279ce9bd6b3fe471626656cde0e9de126ae38cc1

`v1.18.11`: 1.18.11

Compare Source

Summary of Changes

Minor Changes:

Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #46555, Upstream PR #46516, @giorio94)

Bugfixes:

bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #46249, Upstream PR #45937, @nickolaev)
datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #46085, Upstream PR #45799, @bersoare)
Fix memory leak issue with reusing a watch channel hash map from very large StateDB transactions (#46498, @joamaki)
Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #46234, Upstream PR #45371, @syedazeez337)
multipool: Fix retries for CiliumNode Get errors (Backport PR #46410, Upstream PR #46124, [@&chore(deps): update helm chart telegraf-ds to v1.0.34 #8

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Moscow)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

mglants-bot · 2026-06-16T19:19:48Z

--- kubernetes/subterra/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

+++ kubernetes/subterra/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

       chart: cilium
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.18.10
+      version: 1.18.14
   interval: 30m
   values:
     bgp:
       enabled: false
     bgpControlPlane:
       enabled: true

mglants-bot · 2026-06-16T19:19:49Z

--- kubernetes/berries/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

+++ kubernetes/berries/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

       chart: cilium
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.18.13
+      version: 1.18.14
   interval: 30m
   values:
     bgp:
       enabled: false
     bgpControlPlane:
       enabled: true

| datasource | package | from | to | | ---------- | -------------------------------- | -------- | -------- | | helm | cilium | 1.18.10 | 1.18.14 | | helm | cilium | 1.18.13 | 1.18.14 | | docker | quay.io/cilium/cilium | v1.18.10 | v1.18.14 | | docker | quay.io/cilium/hubble-relay | v1.18.10 | v1.18.14 | | docker | quay.io/cilium/hubble-ui | v0.13.5 | v0.13.6 | | docker | quay.io/cilium/hubble-ui-backend | v0.13.5 | v0.13.6 | | docker | quay.io/cilium/operator-generic | v1.18.10 | v1.18.14 |

renovate Bot added renovate/container renovate/helm type/patch labels Jun 16, 2026

mglants-bot Bot added area/kubernetes cluster/subterra cluster/berries labels Jun 16, 2026

renovate Bot force-pushed the renovate/patch-cilium branch from 7478718 to 036c296 Compare June 22, 2026 17:52

renovate Bot force-pushed the renovate/patch-cilium branch 3 times, most recently from fc03a8a to c135cb9 Compare July 20, 2026 23:18

renovate Bot force-pushed the renovate/patch-cilium branch 2 times, most recently from a96c91f to 9ef15fd Compare August 18, 2026 15:16

renovate Bot force-pushed the renovate/patch-cilium branch from 9ef15fd to 2ca2f3c Compare August 26, 2026 11:03

renovate Bot force-pushed the renovate/patch-cilium branch 4 times, most recently from 4689f33 to 7578744 Compare September 8, 2026 15:05

renovate Bot force-pushed the renovate/patch-cilium branch 3 times, most recently from d468aef to b65f44a Compare September 16, 2026 06:05

renovate Bot force-pushed the renovate/patch-cilium branch from b65f44a to 7ade310 Compare September 16, 2026 10:06

Navigation Menu

fix(helm): update cilium group (patch) - #2991

fix(helm): update cilium group (patch)#2991
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/patch-cilium

renovate Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

mglants-bot Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

mglants-bot Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.18.14: 1.18.14

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.13: 1.18.13

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.12: 1.18.12

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.11: 1.18.11

Summary of Changes

Configuration

Uh oh!

mglants-bot Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mglants-bot Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 16, 2026 •

edited

Loading

`v1.18.14`: 1.18.14

`v1.18.13`: 1.18.13

`v1.18.12`: 1.18.12

`v1.18.11`: 1.18.11

mglants-bot Bot commented Jun 16, 2026 •

edited

Loading

mglants-bot Bot commented Jun 16, 2026 •

edited

Loading