chore(deps): update helm release cilium to v1.16.15

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	1.16.5 -> 1.16.15

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cilium/cilium (cilium)

v1.16.15: 1.16.15

Compare Source

⚠️ ⚠️ ⚠️ ⚠️
The v1.16.14 was never released due to a release process bug after tagging. The following summary of changes are based on the v1.16.13.
⚠️ ⚠️ ⚠️ ⚠️

Summary of Changes

CI Changes:

• .github/workflows: simplify ginkgo workflow (Backport PR #​41619, Upstream PR #​41396, @​aanm)
• .github: Don't overwrite junit results (Backport PR #​41042, Upstream PR #​39159, @​joestringer)
• .github: fix upload artifacts for features.json (Backport PR #​41372, Upstream PR #​41119, @​aanm)
• .github: Run final steps when tests aren't skipped (Backport PR #​41042, Upstream PR #​40180, @​joestringer)
• [v1.16] images: update cilium-{runtime,builder} (#​41696, @​tklauser)
• add missing extraArgs in CI (Backport PR #​41372, Upstream PR #​41005, @​aanm)
• builder: Add tparse,junit tooling (Backport PR #​41042, Upstream PR #​39092, @​joestringer)
• Centralize dynamic test ownership configuration (Backport PR #​41042, Upstream PR #​38045, @​joestringer)
• checkpatch: bump checkpatch version, and minor adaptations (Backport PR #​41372, Upstream PR #​41290, @​giorio94)
• CI: Add merge and upload composite action (Backport PR #​41042, Upstream PR #​35355, @​brlbil)
• ci: simplify scheduled test (Backport PR #​41264, Upstream PR #​41261, @​brlbil)
• CLI: Attribute tests to codeowners (Backport PR #​41042, Upstream PR #​37027, @​joestringer)
• Emit junit output from BPF unit tests (Backport PR #​41042, Upstream PR #​39099, @​joestringer)
• gha: run checkpatch check only on PR events (Backport PR #​41372, Upstream PR #​41308, @​giorio94)
• Improved test failure attribution on stable branches by using TESTOWNERS files to route failures to appropriate code quality teams rather than generic CI infrastructure teams. (Backport PR #​41042, Upstream PR #​40776, @​pillai-ashwin)
• pkg/metrics: define default CIDR policies values (Backport PR #​41473, Upstream PR #​41422, @​aanm)
• TESTOWNERS: Import cilium-cli owners from main (#​41375, @​joestringer)
• Upload junit results for Go unit test runs (Backport PR #​41042, Upstream PR #​39015, @​joestringer)

Misc Changes:

• .github/workflows: add step 5 as part of the image build process (Backport PR #​41179, Upstream PR #​41113, @​aanm)
• build-images-release: specify main branch on reusable jobs (Backport PR #​41179, Upstream PR #​41530, @​aanm)
• checkpatch: Update image digest (Backport PR #​41473, Upstream PR #​41360, @​HadrienPatte)
• chore(deps): update all github action dependencies (v1.16) (#​41355, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​41445, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​41571, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​41670, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​41342, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​41442, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​41511, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​41614, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​41718, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v32 (v1.16) (#​41225, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v32.1 (v1.16) (#​41669, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.6 docker digest to 714ad64 (v1.16) (#​41354, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.6 docker digest to 8d9e57c (v1.16) (#​41443, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.7 docker digest to 5e9d14d (v1.16) (#​41666, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.7 (v1.16) (#​41570, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.7-1756004918-79963736ba1b039ff10f7dcb65fa43c5dd6556ed (v1.16) (#​41359, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.9-1757593597-298d4cf0a4058d027aa846ef3647123e8411d2b0 (v1.16) (#​41667, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​41444, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​41668, @​cilium-renovate[bot])
• cli: Load code owners dynamically via --code-owners (Backport PR #​41042, Upstream PR #​38044, @​joestringer)
• cli: Support filtering --log-code-owners (Backport PR #​41042, Upstream PR #​37905, @​joestringer)
• docs: document portmap binary requirements (Backport PR #​41372, Upstream PR #​41300, @​nbusseneau)
• Fix release script steps (Backport PR #​41179, Upstream PR #​41502, @​aanm)
• install: bump startup script version (Backport PR #​41372, Upstream PR #​41299, @​Artyop)
• lower log severity for stale metadata to avoid CI issue (Backport PR #​41473, Upstream PR #​41389, @​liyihuang)
• Makefile: Fix multi codeowner detection (Backport PR #​41042, Upstream PR #​40923, @​joestringer)
• Makefile: Improve tparse,junit output handling (Backport PR #​41042, Upstream PR #​39098, @​joestringer)
• metrics/features: remove aws-vpc-cni (Backport PR #​41593, Upstream PR #​41498, @​aanm)
• Prepare for release v1.16.14 (#​41723, @​cilium-release-bot[bot])
• tools: Move codeowners library from cilium-cli dir (Backport PR #​41042, Upstream PR #​40253, @​joestringer)
• Update all github action dependencies (v1.16) (#​41224, @​cilium-renovate[bot])
• Update all-dependencies (v1.16) (#​41128, @​cilium-renovate[bot])
• Update docker.io/library/golang:1.24.6 Docker digest to e155b51 (v1.16) (#​41222, @​cilium-renovate[bot])
• Update stable lvh-images (v1.16) (patch) (#​41223, @​cilium-renovate[bot])

Other Changes:

• [v1.16] envoy: Start serving listeners only after clusters have been ACKed (#​41607, @​jrajahalme)
• [v1.16] Pr/jrajahalme/41721 backport 1.16 (#​41735, @​jrajahalme)
• CI: Fix junit upload for v1.16 (#​41686, @​joestringer)
• Fix a bug that caused the kernel verifier on pre-v5.7 kernels to reject the bpf_sock program with "invalid func unknown#122" when the LocalRedirectPolicy feature is enabled. (#​41457, @​julianwiedmann)
• install: Update image digests for v1.16.13 (#​41180, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.15@​sha256:c0fa87d70a7ba624fbe581d40a7b7e9e8773a6efd4bb17d0bd14ff854039ec75

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.15@​sha256:7b44efa93e0428511341005e493efb8aa88efd369901c07f8832dc5b3d669a2d

docker-plugin

quay.io/cilium/docker-plugin:v1.16.15@​sha256:13023f0825ef3df62e3f108480fab6f3539bcde05a51c435bf79985eea816a33

hubble-relay

quay.io/cilium/hubble-relay:v1.16.15@​sha256:713f46f45f5e5c67c0f3e25c98669760f05b7f22b4a6a2b0b9934839a833618d

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.15@​sha256:26b6da245ec124a7d5c12a0d05de75e0da272a67f802e59ebb95d328255232b3

operator-aws

quay.io/cilium/operator-aws:v1.16.15@​sha256:bb914f013c4a2548ff6028af63fb8bcf730c173d5bf8a57efef150da2614a6ac

operator-azure

quay.io/cilium/operator-azure:v1.16.15@​sha256:41ba9911403a151e79aa5544949e40839019ba0fa4600f366b4c3a544ae572eb

operator-generic

quay.io/cilium/operator-generic:v1.16.15@​sha256:fea37022f858272c27cefe6b4959d45e2ca03d957decbfa210ce35931f346ecd

operator

quay.io/cilium/operator:v1.16.15@​sha256:aadf3c529e7838c8a7de5ad196ccdd6d5797664e1afd5ddefd7830ae28835cf5

v1.16.13: 1.16.13

Compare Source

Summary of Changes

Minor Changes:

• Add kernel_version, endpoint_routes_enabled, strict_mode_enabled and kubernetes_version feature metrics. (Backport PR #​41073, Upstream PR #​41003, @​aanm)

Bugfixes:

• bgp: Use private fork of the GoBGP to fix BGP MD5 auth (Backport PR #​40579, Upstream PR #​40566, @​YutaroHayakawa)
• Helm: Correct seccompProfile for cilium-agent pods (Backport PR #​40579, Upstream PR #​40476, @​jcpunk)
• install/kubernetes: fix clustermesh-apiserver extraEnv (Backport PR #​41073, Upstream PR #​41021, @​aanm)

CI Changes:

• .github/actions: only upload files with features-tested prefix (Backport PR #​40989, Upstream PR #​40975, @​aanm)
• [v1.16] .github: Remove use of cosign attest --recursive (#​40700, @​YutaroHayakawa)
• [v1.16] ci: Revert build_commits runner to ubuntu-22.04 (#​40867, @​rastislavs)
• ci: conformance-eks token extended to 8h (Backport PR #​40579, Upstream PR #​40474, @​mathpl)
• ci: more powerful runners for go linting (Backport PR #​40764, Upstream PR #​40582, @​mathpl)
• Fix GKE cluster creation failures when branch names exceed 63-byte label limit by implementing automatic truncation with hash-based uniqueness preservation. (Backport PR #​40851, Upstream PR #​40725, @​pillai-ashwin)
• spire: Fix unreliable test (Backport PR #​40663, Upstream PR #​40561, @​joestringer)

Misc Changes:

• .github/workflows: bump build-images-base timeout to 60 minutes (Backport PR #​40989, Upstream PR #​40919, @​aanm)
• .github: fix removal of all files in /mnt (Backport PR #​40851, Upstream PR #​40818, @​aanm)
• .github: fix upload artifacts for features.json (#​41089, @​aanm)
• .github: remove all contents of /mnt in build images CI (Backport PR #​40851, Upstream PR #​40814, @​aanm)
• chore(deps): update actions/download-artifact action to v5 (v1.16) (#​41061, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​40750, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​40909, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​41062, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​40747, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​40985, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.18.6 (v1.16) (#​40906, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.26 (v1.16) (#​40647, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v31.1 (v1.16) (#​40749, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang docker tag to v1.24.5 (v1.16) (#​40748, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.6 (v1.16) (#​40995, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.6-1753919866-df8077dbd3932edccb59f1c5c70e01f2c1f63741 (v1.16) (#​40907, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​40674, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​40908, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​41060, @​cilium-renovate[bot])
• ci: add/change runner labels (Backport PR #​40989, Upstream PR #​40972, @​Artyop)
• daemon/test: explicitly wait for identities synchronization (Backport PR #​40851, Upstream PR #​40811, @​giorio94)
• doc:monitor: clarify direction traced with default aggregation level (Backport PR #​40580, Upstream PR #​40398, @​smagnani96)
• docs: Add missing IPAM modes to configuration page (Backport PR #​40663, Upstream PR #​40540, @​RayyanSeliya)
• docs: Add warning about changing an IP pool (Backport PR #​40663, Upstream PR #​40567, @​sorrison)
• docs: Extend Hubble Performance Tuning Documentation (Backport PR #​40580, Upstream PR #​34665, @​glrf)
• docs: remove l7 EnableDefaultDeny callout (Backport PR #​40579, Upstream PR #​40441, @​squeed)
• policy: redact sensitive tls context properties for logging (Backport PR #​40579, Upstream PR #​40417, @​fristonio)

Other Changes:

• images: update cilium-{runtime,builder} (#​40840, @​aanm)
• install: Update image digests for v1.16.12 (#​40545, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.13@​sha256:ea59f51ba72cded67e6d2161192db680f422f0a3abfb1b8c37d0c3f1d5a934fd

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.13@​sha256:c42f514226a7942d1ad0e24737f4af3e51f03cb5ebe8de3731b6ae204768edff

docker-plugin

quay.io/cilium/docker-plugin:v1.16.13@​sha256:6e5bb7438f26268a9b9a4ded53a4d2df7324f40dfe212f2d7bba4a8bb6d0b4e4

hubble-relay

quay.io/cilium/hubble-relay:v1.16.13@​sha256:55f659befd04e576348fbe6e06e52679dab4ae719301d22ce8cb131c4076e885

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.13@​sha256:dd7721dbeaeb1cf7caf3345c28530ab3e9b8df7726d535e5753f3c87fe1df762

operator-aws

quay.io/cilium/operator-aws:v1.16.13@​sha256:ffda94d43189a8c336dc018580703dad0b7b09e0f7d2b26b7633b08c2ebe78b8

operator-azure

quay.io/cilium/operator-azure:v1.16.13@​sha256:e1ab6a0aecb8a9d9b7fcc36b3c7a568ae4fdf13ffab45e8eaaf76673cce8cf3e

operator-generic

quay.io/cilium/operator-generic:v1.16.13@​sha256:94d0bed62d981b9ebd8d5041206705a92c49e7b3cfdabca9c4611f04ac82abc2

operator

quay.io/cilium/operator:v1.16.13@​sha256:cad7dba55e741da80f7ae6cae745713b5945448a1bae63c9b1fe06ca25d664c9

v1.16.12: 1.16.12

Compare Source

Summary of Changes

Bugfixes:

• Fix CIDRGroupRef handling in cilium network policy rule spec. (#​40139, @​fristonio)
• LBIPAM: Fix deletion of CiliumLoadBalancerIPPool with multiple IP blocks that led to an operator crash (Backport PR #​40093, Upstream PR #​40013, @​pippolo84)
• pkg/egressgateway: ensure gateway IP is IPv4 (Backport PR #​40331, Upstream PR #​40209, @​rgo3)

CI Changes:

• Backported setting egressMasqueradeInterfaces and concurrent test runs to fix ci-eks workflow. (#​40468, @​jrajahalme)

Misc Changes:

• .github/workflows: remove reviewers if ciliumbot approved PR (Backport PR #​40093, Upstream PR #​39989, @​aanm)
• auto-approve: add repository as part command (Backport PR #​40093, Upstream PR #​40050, @​aanm)
• auto-approve: add repository as part command (Backport PR #​40331, Upstream PR #​40089, @​aanm)
• chore(deps): update all-dependencies (v1.16) (#​40159, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​40370, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.18.5 (v1.16) (#​40327, @​cilium-renovate[bot])
• chore(deps): update dependency go to v1.24.5 (v1.16) (#​40425, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.4 docker digest to 20a022e (v1.16) (#​40160, @​cilium-renovate[bot])
• contrib/git: add merge drivers to automate post-merge commands (Backport PR #​40292, Upstream PR #​40189, @​aanm)
• disk-cleanup: parallelize cleanup process to speed up step (Backport PR #​40093, Upstream PR #​40054, @​aanm)
• docs/ipsec: Fix incorrect statement on hostns encryption (Backport PR #​40173, Upstream PR #​40133, @​pchaigno)
• Makefile: Require API generation commands to succeed (Backport PR #​40206, Upstream PR #​40199, @​joestringer)
• operator/secretsync: silence reconciliation logs (Backport PR #​40226, Upstream PR #​40217, @​tklauser)
• proxy: Use upstream envoy control plane API (Backport PR #​40242, Upstream PR #​39672, @​sayboras)

Other Changes:

• [v1.16] deps: Update cilium-envoy image to 1.33.x (#​40163, @​sayboras)
• Bpf datapath TCP conntrack entries are (re)created only in the forward direction, solving an issue with freezing proxy connections when backend connection is re-opened. (#​40449, @​jrajahalme)
• install: Update image digests for v1.16.11 (#​40115, @​cilium-release-bot[bot])
• v1.16: docs: Document encapsulation options (#​40472, @​pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.12@​sha256:2474c606db9ac02ffad692a5115f48cdf1a6eb1856c312b2b08d2dd3ce3e9317

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.12@​sha256:6e4d3ea9c9cca18e90a542b717fec447a9bdf927de2013f4541818227f53754a

docker-plugin

quay.io/cilium/docker-plugin:v1.16.12@​sha256:20c8f247b0ebf1211166435ca4c22249964106d0653d88bf70219341c972d39d

hubble-relay

quay.io/cilium/hubble-relay:v1.16.12@​sha256:56a9eaf18788a8ee7b952c86f535b5484a6ac102dde6c26e5aa3242f01190e80

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.12@​sha256:9ce7167bfb474f50a2c2951ddb9c0594609c6e1f6a15da22a2b23b7cc3eb6c5b

operator-aws

quay.io/cilium/operator-aws:v1.16.12@​sha256:819b328ad2486e2f8b50d9b0d0d2dfc9f576cacdd12134737dacde0f69715d95

operator-azure

quay.io/cilium/operator-azure:v1.16.12@​sha256:0825386e3411ca37f1bbd4d986c815a99b58f478bd5e1751b930065140694af8

operator-generic

quay.io/cilium/operator-generic:v1.16.12@​sha256:aafeefcc7f219fd4b6da8402c910fcf343c926383b351cb3fb911f7671e32c64

operator

quay.io/cilium/operator:v1.16.12@​sha256:c35873321886d8d05abf1a52598b7cd06c74e0cc367737cd763b56c42d0f6662

v1.16.11: 1.16.11

Compare Source

Summary of Changes

Bugfixes:

• Fixed bug where datapath is unable to compile when active connection tracking and IPv6 are enabled at the same time. (Backport PR #​39563, Upstream PR #​39509, @​dylandreimerink)
• Policy updates to Envoy no longer consider a single selector as an L3 wildcard. Cilium bpf datapath policy enforcement is not done for Cilium Ingress policy enforcement so the L3 identity needs to be enforced in all cases. (Backport PR #​39563, Upstream PR #​39511, @​jrajahalme)

CI Changes:

• bpf: test: fix up mis-spelled HAVE_NETNS_COOKIE (Backport PR #​39563, Upstream PR #​39420, @​julianwiedmann)
• call for metrics in smoke tests from runner instead of installing apt/curl on cilium pod (Backport PR #​39863, Upstream PR #​37362, @​Artyop)
• Re-optimize CI build process (Backport PR #​39863, Upstream PR #​39802, @​aanm)

Misc Changes:

• Add a section to talk about the native routing masquerading in the cloud environment. (Backport PR #​39563, Upstream PR #​39343, @​liyihuang)
• bpf: Skip lxc src IP check for proxy traffic (Backport PR #​39563, Upstream PR #​39530, @​sayboras)
• chore(deps): update all github action dependencies (v1.16) (#​39320, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​39711, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​39571, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​39705, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​39880, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v31 (v1.16) (#​39610, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.3 docker digest to 4c0a181 (v1.16) (#​39706, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.3 docker digest to 86b4cff (v1.16) (#​39608, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.4 (v1.16) (#​39952, @​cilium-renovate[bot])
• chore(deps): update kindest/node docker tag to v1.30.13 (v1.16) (#​39609, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1749031919-98c55b1d0c1154fb6c9e760583c2dcd7778686e2 (v1.16) (#​39887, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1749271279-0864395884b263913eac200ee2048fd985f8e626 (v1.16) (#​39936, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​39707, @​cilium-renovate[bot])
• pkg/fswatcher: Rewrite without underlying use of fsnotify (Backport PR #​39964, Upstream PR #​38537, @​glibsm)

Other Changes:

• [v1.16] ci: don't run k8s conformance tests in conformance-k8s-kind (#​40010, @​tklauser)
• [v1.16] proxy: Bump cilium/proxy version (#​39591, @​sayboras)
• install: Update image digests for v1.16.10 (#​39547, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.11@​sha256:62b179173d9d3f32bdd09023887898e7eeb9cc211fdcc787a54007eb931e5d57

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.11@​sha256:60f2322bedb4211aefc99c2d156f6195b05ecbf5dc349213de4b4fc3086db97b

docker-plugin

quay.io/cilium/docker-plugin:v1.16.11@​sha256:f8159930333ad8d4795365cdd20149d0cf07208324a2d4d68c73fc8fb0c8e4b6

hubble-relay

quay.io/cilium/hubble-relay:v1.16.11@​sha256:332d66b17d0a1248b2d5b36d991a37bbaa23ac209a9de92fc3f4baa074d97310

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.11@​sha256:6fca4b1243a9ed66eb908851ccddc92a97e8c429b6f78f73104663738d0ed4b2

operator-aws

quay.io/cilium/operator-aws:v1.16.11@​sha256:507295bd07da671bf74d5bb0a478f244469be493eff1474933e31d0c50e16d85

operator-azure

quay.io/cilium/operator-azure:v1.16.11@​sha256:d7cc7d82e5a6726b3a71ba6fb98bbefb662f9be7d659867437872e869fe726a0

operator-generic

quay.io/cilium/operator-generic:v1.16.11@​sha256:b66f5243f544303c74fa1a7104914afa497012a47a51a62dcb6ceaac5461b602

operator

quay.io/cilium/operator:v1.16.11@​sha256:4b2af48ed98211e592233b2bf86de4515435eaf3625a7218cb80a055475b3508

v1.16.10: 1.16.10

Compare Source

Summary of Changes

Minor Changes:

• daemon: Make cilium status independent from k8s status (Backport PR #​38536, Upstream PR #​32724, @​tkna)
• Update kafka apiKey helm chart value to true (Backport PR #​39215, Upstream PR #​38963, @​kyle-c-simmons)

Bugfixes:

• Fix a bug where a CiliumNetworkPolicy/CiliumClusterwideNetworkPolicy containing invalid rules would not be reported with invalid status. (Backport PR #​38949, Upstream PR #​38801, @​tklauser)
• Fix a deadlock when a host has no IPv4 address. (Backport PR #​39077, Upstream PR #​38938, @​EmilyShepherd)
• Fix a panic happening in the ipset reconciler when a previous reconciliation failed. (Backport PR #​38949, Upstream PR #​38890, @​pippolo84)
• Fix bug that would cause the cilium-dbg encrypt status command to not list any decryption interfaces when KPR is enabled. (Backport PR #​39215, Upstream PR #​39170, @​pchaigno)
• Fixes a bug where layer-7 rules would override enableDefaultDeny: false, incorrectly dropping traffic. (Backport PR #​39382, Upstream PR #​38841, @​nimishamehta5)
• ipsec: Fix key derivation error in case of corrupted boot IDs (Backport PR #​39077, Upstream PR #​39059, @​pchaigno)
• k8s: Fixed a case when delete event for service endpointslices might have been missed if connectivity to k8s apiserver was broken causing stale service cache for service. (Backport PR #​38949, Upstream PR #​38779, @​marseel)

CI Changes:

• [v1.16] l4lb: Support environments with existing veth (#​39409, @​joestringer)
• bpf: tests: fix ethertype when building inner headers of VXLAN packet (Backport PR #​39077, Upstream PR #​39060, @​julianwiedmann)
• integration: Bump ubuntu to 24.04 for arm runners (Backport PR #​39215, Upstream PR #​37042, @​sayboras)
• rate: Disable TestStressRateLimiter (Backport PR #​38895, Upstream PR #​38877, @​YutaroHayakawa)

Misc Changes:

• [v1.16] deps: bump CNI plugins version (#​39331, @​ferozsalam)
• [v1.16] deps: bump github.com/osrg/gobgp/v3 to v3.35.0 (#​39225, @​ferozsalam)
• [v1.16] deps: bump golang-jwt to 4.5.2 (#​39495, @​ferozsalam)
• Add the doc for multi-pool ipam about how to update the existing ip pool (Backport PR #​38949, Upstream PR #​38539, @​liyihuang)
• chore(deps): update all github action dependencies (v1.16) (#​39051, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​39185, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​39325, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.23.8 docker digest to 87bb940 (v1.16) (#​38912, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.23.8 docker digest to e54daaa (v1.16) (#​39049, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.2 docker digest to 30baaea (v1.16) (#​39317, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.3 (v1.16) (#​39381, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1744328671-a8b58b35c03a3d100a2b026fc111417207183301 (v1.16) (#​38913, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1744798797-f7456c0c30336bbd437eff7743374370e415fc44 (v1.16) (#​39050, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1745916268-e485bbc0c95e30aa233cb06a753789375b12ad18 (v1.16) (#​39227, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1745971871-f98500f20b253684d483b783b29df2e4db05ea7c (v1.16) (#​39257, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c (v1.16) (#​39414, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​38914, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​38971, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​39184, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​39319, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​39477, @​cilium-renovate[bot])
• chore: remove retention-days param in build-images-releases.yaml (Backport PR #​39436, Upstream PR #​39431, @​sekhar-isovalent)
• cilium: Fix device controller's dependency on netfilter (Backport PR #​38949, Upstream PR #​38777, @​borkmann)
• contrib/scripts: Fix IndexError in stacktrace script (Backport PR #​39215, Upstream PR #​39101, @​christarazi)
• contrib: Remove kind.sh dependency on git (Backport PR #​39405, Upstream PR #​39154, @​joestringer)
• docs: Add good kernel versions for the L7 policy IPv6 bug (Backport PR #​39405, Upstream PR #​39212, @​gentoo-root)
• docs: add warning about l7 policy and EnableDefaultDeny (Backport PR #​39077, Upstream PR #​38675, @​squeed)
• docs: Document L7 policy IPv6 bug (Backport PR #​38949, Upstream PR #​38591, @​gentoo-root)
• docs: Fix casing and formatting in L3 examples section (Backport PR #​39405, Upstream PR #​39065, @​mikejoh)
• docs: Fix variable naming in EKS-to-EKS Clustermesh guide (Backport PR #​39077, Upstream PR #​38821, @​zzuckerfrei)
• docs: The Installation on OpenShift OKD document has been updated to link to maintained operators for Cilium (Isovalent Enterprise for Cilium). This operator is validated on all current versions of OpenShift. (Backport PR #​39405, Upstream PR #​38886, @​auriaave)
• Documentation : Modification of eks-clustermesh-prep.rst (Backport PR #​39215, Upstream PR #​39025, @​rwinieski)
• documentation: fix get deployment cmd (Backport PR #​39215, Upstream PR #​39155, @​g0gn)
• k8s/resource: Don't Add to WaitGroup asynchronously (Backport PR #​38949, Upstream PR #​38692, @​joamaki)
• maglev: Fix division by zero upon table recreation (Backport PR [#​39077](https://redirect.github.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.