Update module github.com/cilium/cilium to v1.19.4

[ard-wg-k8s-gitbot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cilium/cilium	v1.19.3 → v1.19.4

---

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.19.4: 1.19.4

Compare Source

Summary of Changes

Minor Changes:

• cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR #​45755, Upstream PR #​45504, @​HadrienPatte)
• iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR #​45630, Upstream PR #​45192, @​liyihuang)
• operator/spire: make SPIRE client configurable for ztunnel (Backport PR #​45356, Upstream PR #​44136, @​nddq)
• pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR #​45630, Upstream PR #​45533, @​sjohnsonpal)

Bugfixes:

• bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR #​45695, Upstream PR #​45661, @​julianwiedmann)
• bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR #​45594, Upstream PR #​45588, @​julianwiedmann)
• cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR #​45888, Upstream PR #​44951, @​skymensch)
• cilium: Fix incorrect IPv6 BIG TCP display (Backport PR #​45630, Upstream PR #​45529, @​pchaigno)
• clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR #​45496, Upstream PR #​45402, @​MrFreezeex)
• clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR #​45630, Upstream PR #​45576, @​owayss)
• Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR #​45673, Upstream PR #​44526, @​nebojsaj1726)
• Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR #​45584, Upstream PR #​45522, @​ysksuzuki)
• Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR #​45888, Upstream PR #​45737, @​weizhoublue)
• Fix host L7 policy operation (Backport PR #​45496, Upstream PR #​45030, @​atykhyy)
• Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR #​45630, Upstream PR #​44701, @​hbangT)
• Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR #​45630, Upstream PR #​45557, @​jrife)
• Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR #​45356, Upstream PR #​45179, @​RiccardoAtzori91)
• fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR #​45630, Upstream PR #​44705, @​ieth0)
• fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR #​45630, Upstream PR #​44662, @​aslafy-z)
• fix(ipsec): panic in parseSPI on malformed input (Backport PR #​45496, Upstream PR #​44815, @​isoyuki)
• Fixed intermittent ARP failures for LoadBalancer services caused by pointer reuse during BPF map iteration in the L2 responder reconciler. (Backport PR #​45673, Upstream PR #​45197, @​Krishnachaitanyakc)
• Fixed SocketLB returning EPERM instead of EHOSTUNREACH when a Service has no backends. (Backport PR #​45673, Upstream PR #​45185, @​chez-shanpu)
• Fixes an issue where L7 LoadBalancer and Ingress traffic would be dropped on certain kernel versions when Cilium is attached to a bridge network device. (Backport PR #​45755, Upstream PR #​45582, @​liyihuang)
• Fixes dropped packets on ingress when full header not in linear skb area (Backport PR #​45496, Upstream PR #​45195, @​javiercardona-work)
• hubble-relay: fix TLS config variable shadowing preventing cleanup on shutdown (Backport PR #​45630, Upstream PR #​45085, @​Aprazor)
• policy: Fix CCG matching for duplicate label keys (Backport PR #​45356, Upstream PR #​45225, @​christarazi)
• Respect backends for BGP only when they are in state: active (Backport PR #​45673, Upstream PR #​45286, @​CallMeFoxie)
• secretsync recreate synced secret when source secret type changes (Backport PR #​45888, Upstream PR #​45721, @​ssam18)
• wireguard: clamp cilium_wg0 MTU to IPV6_MIN_MTU (1280) when IPv6 is enabled, preventing silent packet loss in tunnel+encryption mode with constrained path MTU (Backport PR #​45496, Upstream PR #​45425, @​tibrezus)

CI Changes:

• .github/workflows: skip full test suite for workflow_dispatch on dev … (Backport PR #​45356, Upstream PR #​45285, @​aanm)
• complexity-diff: Small improvements (Backport PR #​45673, Upstream PR #​45556, @​pchaigno)
• contrib: fix typo in identity_is_node.cocci (Backport PR #​45630, Upstream PR #​45505, @​julianwiedmann)
• datapath/loader: Add map count to verifier complexity records (Backport PR #​45673, Upstream PR #​44652, @​dylandreimerink)
• gha/clustermesh: use OCI registry for cert-manager (Backport PR #​45356, Upstream PR #​45326, @​giorio94)
• logging: Update leader election log level override (Backport PR #​45496, Upstream PR #​45358, @​joamaki)
• Use extra power github runner if available for multi-pool CI workflow (Backport PR #​45673, Upstream PR #​45555, @​fristonio)

Misc Changes:

• [v1.19] deps: bump x/net to v0.53 (#​45935, @​ferozsalam)
• Add documentation and warnings on DNS interception (Backport PR #​45888, Upstream PR #​45525, @​ferozsalam)
• chore(deps): update all external docker images dependencies to v0.13.5 (v1.19) (patch) (#​45462, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​45467, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​45728, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​45747, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​45870, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​45882, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​45466, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​45615, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​45729, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.10 (v1.19) (#​45902, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 354584b (v1.19) (#​45614, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 6663075 (v1.19) (#​45481, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 6e3229e (v1.19) (#​45620, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to b782452 (v1.19) (#​45488, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.69.0 (v1.19) (#​45872, @​cilium-renovate[bot])
• chore(deps): update module github.com/moby/spdystream to v0.5.1 [security] (v1.19) (#​45431, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260416084302-2b3d1fe14578 (v1.19) (#​45463, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260423112246-3fa174937a6b (v1.19) (#​45730, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260505141229-de8f85687fd2 (v1.19) (#​45881, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.3 (v1.19) (#​45501, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.6-1776352947-78da350f53f63526ff6487f2e1f3b14d2062ce17 (v1.19) (#​45464, @​cilium-renovate[bot])
• ci: make registry configurable (#​45437, @​Artyop)
• docs(policy): update namespace label support (Backport PR #​45630, Upstream PR #​44922, @​lconnery)
• docs: add small CiliumCIDRGroup scalability callout (Backport PR #​45888, Upstream PR #​45763, @​squeed)
• Fail hive health tree script command if no status is found for filter (Backport PR #​45888, Upstream PR #​45554, @​fristonio)
• Fix Endpoint regeneration health reporting (Backport PR #​45630, Upstream PR #​45011, @​fristonio)
• fix(deps): update k8s.io patch updates stable to v0.35.4 (v1.19) (patch) (#​45465, @​cilium-renovate[bot])
• helm: allow overriding of external images in charts (Backport PR #​45634, Upstream PR #​45597, @​sekhar-isovalent)
• helm: do not set operator health port as hostPort when hostNetwork is disabled (Backport PR #​45673, Upstream PR #​45386, @​robinelfrink)
• loadbalancer/reflectors: Filter EndpointSlice watch by service labels (Backport PR #​45755, Upstream PR #​45528, @​HadrienPatte)

Other Changes:

• [v1.19] ipam: fix data race in MultiPoolManager node update (#​45521, @​Kunalbehbud)
• chore(deps): update quay.io/cilium/cilium-envoy (#​45908, @​sayboras)
• install: Restore RBAC for ciliumbgppeeringpolicies to allow for gradual upgrade of Cilium pods from v1.18 to v1.19. (#​45829, @​rastislavs)
• install: Update image digests for v1.19.3 (#​45401, @​cilium-release-bot[bot])
• v1.19: bpf: Reduce stack usage and complexity of tail_handle_snat_fwd_ipv6 (#​45360, @​pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.4@​sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.4@​sha256:9e40006b2e2b6e66d047f9af52577a93b39d9532958ec6d88d46820bb59ab643

docker-plugin

quay.io/cilium/docker-plugin:v1.19.4@​sha256:720dc5839de8c30acf655ad790866cf89b7691047a020e7b4a4bd66883fbf4d1

hubble-relay

quay.io/cilium/hubble-relay:v1.19.4@​sha256:59af8c0d561e560c2a042e7600a3496bc0367df8fbf868aa68d5834c8ec1a431

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.4@​sha256:693b1e61f22beaa9a0f68aa4056ba873465da96da6382f3276978d01544450dd

operator-aws

quay.io/cilium/operator-aws:v1.19.4@​sha256:9e41b3959d941a0b60ba187f5a2572305846248efb89ac59c18fd25a032f568d

operator-azure

quay.io/cilium/operator-azure:v1.19.4@​sha256:8203f4e5e65c658fe2367a570c7bba5779859982bd3cc263662e35e690be3417

operator-generic

quay.io/cilium/operator-generic:v1.19.4@​sha256:1aa2b62735e7d8ab49ee840ae59c346932024c88901579121395c1271b435f71

operator

quay.io/cilium/operator:v1.19.4@​sha256:7edc61725901e32a13e180c5290d43df5292f5f49c6d654c94a0be2faf52e71e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

➡️ Go test coverage stayed the same at 78.6% compared to 6a63288 (2 ignored files)

No change in coverage for any package.

View coverage for all packages

# Package Name                                               | Coverage
+ code.cloudfoundry.org/k8s-policy-agent/internal/agent      |    43.8%
+ code.cloudfoundry.org/k8s-policy-agent/internal/config     |   100.0%
+ code.cloudfoundry.org/k8s-policy-agent/internal/reconciler |    88.4%