fix(helm): update chart cilium ( 1.19.5 ➔ 1.19.6 ) by renovate[bot] · Pull Request #3262 · anthr76/infra

renovate · 2026-07-16T19:54:29Z

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.19.5` → `1.19.6`

Release Notes

cilium/cilium (cilium)

`v1.19.6`: 1.19.6

Compare Source

Summary of Changes

Minor Changes:

datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #46845, Upstream PR #46332, @bersoare)
gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev)

Bugfixes:

[v1.19] Fix policy service label selector handling (#46946, @fristonio)
bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #46669, Upstream PR #46325, @atykhyy)
doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #47181, Upstream PR #47144, @HadrienPatte)
endpoint: Fix race when reading endpoint properties (Backport PR #47181, Upstream PR #46991, @gandro)
Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #46975, Upstream PR #46668, @Suyash1700)
Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #46793, Upstream PR #46747, @giorio94)
Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #46974, Upstream PR #46927, @aanm)
Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #46826, Upstream PR #45693, @eufriction)
Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #46669, Upstream PR #44748, @shibaPuppy)
Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #46691, Upstream PR #46635, @mkamadeus)
Fix ctmap gc duration metric recording (Backport PR #46975, Upstream PR #46873, @fristonio)
Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47002, Upstream PR #46821, @fristonio)
Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #47181, Upstream PR #46967, @ysksuzuki)
Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #47181, Upstream PR #46444, @giorio94)
Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #46793, Upstream PR #46710, @gentoo-root)
Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #46793, Upstream PR #46643, @squeed)
gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #46837, Upstream PR #46350, @xtineskim)
gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #46826, Upstream PR #44889, @eufriction)
ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47181, Upstream PR #46867, @pippolo84)
operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #47181, Upstream PR #47127, @HadrienPatte)

CI Changes:

.github: Generate CI binaries with correct module version (Backport PR #47099, Upstream PR #46742, @joestringer)
chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #46920, Upstream PR #46840, @sekhar-isovalent)
ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #46691, Upstream PR #46632, @nebril)
ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #46888, Upstream PR #46451, @nebril)
Fix workflow change detection for single-commit PRs to main (Backport PR #46793, Upstream PR #46684, @Demiserular)
Further GC ratchet test fix races (Backport PR #47224, Upstream PR #43075, @tommyp1ckles)

Misc Changes:

(minor) docs: update reference to aws-cli image (Backport PR #46975, Upstream PR #46923, @squeed)
.github: allow fork PR checkout with actions/checkout v7 (Backport PR #47135, Upstream PR #47133, @aanm)
[v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#46613, @aanm)
[v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#46574, @aanm)
[v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#47083, @giorio94)
bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #46920, Upstream PR #46383, @martonra)
bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #47181, Upstream PR #47021, @pchaigno)
chore(deps): update all github action dependencies (v1.19) (#46658, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46908, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47109, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#46906, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#47045, @cilium-renovate[bot])
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#47124, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#46774, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.12 (v1.19) (#46982, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#46726, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#46773, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#46657, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#47039, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#46700, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#47122, @cilium-renovate[bot])
chore: BYOCNI loopback for cilium (Backport PR #46691, Upstream PR #46646, @sekhar-isovalent)
chore: optimize building gops and cni/loopback (Backport PR #46845, Upstream PR #46781, @sekhar-isovalent)
ci: always set fail-fast to false on image builds (Backport PR #47181, Upstream PR #47064, @aanm)
ci: remove non-ariane workflows from config (Backport PR #46845, Upstream PR #46787, @nebril)
clustermesh: add reusable backend selector constructor (Backport PR #46691, Upstream PR #45648, @viktor-kurchenko)
docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #47181, Upstream PR #47026, @maksymbilokur-cisco)
docs: fix note about ipv4-native-routing-cidr default value (Backport PR #46793, Upstream PR #46603, @rptaylor)
Egress Gateway: handle nil events (Backport PR #47181, Upstream PR #46476, @tommyp1ckles)
endpoint: reap restart-preserved policy map entries once ready (Backport PR #47063, Upstream PR #47062, @aanm)
endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #47076, Upstream PR #47075, @aanm)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46793, Upstream PR #46388, @tommyp1ckles)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46845, Upstream PR #46388, @tommyp1ckles)
fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#46907, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#47115, @cilium-renovate[bot])
Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #46826, Upstream PR #44962, @eufriction)
gateway-api: return model from Gateway API ingestion (Backport PR #46933, Upstream PR #46450, @arybolovlev)
gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #47181, Upstream PR #47085, @aanm)
Improve cilium-dbg status output of module health (Backport PR #46845, Upstream PR #46739, @joestringer)
loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #46826, Upstream PR #45949, @eufriction)
loadbalancer: validate DSR dispatch configuration globally (Backport PR #46793, Upstream PR #45545, @FelipeYepez)
Makefile: Generate full Cilium version in worktree (Backport PR #46793, Upstream PR #46737, @joestringer)
Revert restore-path policy map changes (#46927, #47062, #47075) (Backport PR #47213, Upstream PR #47202, @aanm)
Upgraded cilium/ebpf to version v0.22.0 (Backport PR #46845, Upstream PR #46783, @dylandreimerink)

Other Changes:

install: Update image digests for v1.19.5 (#46593, @cilium-release-bot[bot])
v1.19: gateway-api: fix sds secrets in golden tests (#47229, @0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-16T19:55:06Z

qgr1-cluster-0 - kustomization

--- k8s/base/kube-system/cilium Kustomization: flux-system/kube-system-cilium HelmRelease: kube-system/cilium

+++ k8s/base/kube-system/cilium Kustomization: flux-system/kube-system-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

     spec:
       chart: cilium
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.19.5
+      version: 1.19.6
   install:
     createNamespace: true
     remediation:
       retries: 50
     timeout: 15m
   interval: 30m

github-actions · 2026-07-16T19:55:07Z

qgr1-cluster-0 - helmrelease

--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

@@ -74,12 +74,13 @@

   direct-routing-skip-unreachable: 'false'
   enable-bandwidth-manager: 'true'
   enable-bbr: 'true'
   enable-bbr-hostns-only: 'false'
   enable-local-redirect-policy: 'true'
   ipv4-native-routing-cidr: 10.36.0.0/16
+  enable-host-firewall: 'false'
   devices: en+
   kube-proxy-replacement: 'true'
   kube-proxy-replacement-healthz-bind-address: 0.0.0.0:10256
   enable-no-service-endpoints-routable: 'true'
   bpf-lb-sock: 'true'
   bpf-lb-sock-hostns-only: 'true'
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -16,13 +16,13 @@

     rollingUpdate:
       maxUnavailable: 2
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 832590e13e507f2e137adfb34f6a3a60a5ffa708280b5ea31a4d4d614415ee14
+        cilium.io/cilium-configmap-checksum: ce411bbaa7a7cfdb4c96c89676e83153c4adae360b4bca32257031c3d0df07a2
         kubectl.kubernetes.io/default-container: cilium-agent
       labels:
         k8s-app: cilium
         app.kubernetes.io/name: cilium-agent
         app.kubernetes.io/part-of: cilium
     spec:
@@ -30,13 +30,13 @@

         appArmorProfile:
           type: Unconfined
         seccompProfile:
           type: Unconfined
       containers:
       - name: cilium-agent
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         command:
         - cilium-agent
         args:
         - --config-dir=/tmp/cilium/config-map
         startupProbe:
@@ -190,13 +190,13 @@

         - name: xtables-lock
           mountPath: /run/xtables.lock
         - name: tmp
           mountPath: /tmp
       initContainers:
       - name: config
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         command:
         - cilium-dbg
         - build-config
         env:
         - name: K8S_NODE_NAME
@@ -221,13 +221,13 @@

           capabilities:
             add:
             - NET_ADMIN
             drop:
             - ALL
       - name: mount-cgroup
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         env:
         - name: CGROUP_ROOT
           value: /run/cilium/cgroupv2
         - name: BIN_PATH
           value: /opt/cni/bin
@@ -253,13 +253,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: apply-sysctl-overwrites
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         env:
         - name: BIN_PATH
           value: /opt/cni/bin
         command:
         - bash
@@ -283,13 +283,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: mount-bpf-fs
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         args:
         - mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
         command:
         - /bin/bash
         - -c
@@ -299,13 +299,13 @@

           privileged: true
         volumeMounts:
         - name: bpf-maps
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         command:
         - /init-container.sh
         env:
         - name: CILIUM_ALL_STATE
           valueFrom:
@@ -347,13 +347,13 @@

         - name: cilium-cgroup
           mountPath: /run/cilium/cgroupv2
           mountPropagation: HostToContainer
         - name: cilium-run
           mountPath: /var/run/cilium
       - name: install-cni-binaries
-        image: quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732
+        image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
         imagePullPolicy: IfNotPresent
         command:
         - /install-plugin.sh
         resources:
           limits:
             cpu: 1
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy

@@ -28,13 +28,13 @@

     spec:
       securityContext:
         appArmorProfile:
           type: Unconfined
       containers:
       - name: cilium-envoy
-        image: quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed
+        image: quay.io/cilium/cilium-envoy:v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc@sha256:767101fb8a5e38f055778cb43b7aa8eed80450b37f8121effac3d9de9e06dc99
         imagePullPolicy: IfNotPresent
         command:
         - /usr/bin/cilium-envoy-starter
         args:
         - --
         - -c /var/run/cilium/envoy/bootstrap-config.json
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -20,25 +20,25 @@

       maxSurge: 25%
       maxUnavailable: 50%
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 832590e13e507f2e137adfb34f6a3a60a5ffa708280b5ea31a4d4d614415ee14
+        cilium.io/cilium-configmap-checksum: ce411bbaa7a7cfdb4c96c89676e83153c4adae360b4bca32257031c3d0df07a2
       labels:
         io.cilium/app: operator
         name: cilium-operator
         app.kubernetes.io/part-of: cilium
         app.kubernetes.io/name: cilium-operator
     spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cilium-operator
-        image: quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4
+        image: quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665
         imagePullPolicy: IfNotPresent
         command:
         - cilium-operator-generic
         args:
         - --config-dir=/tmp/cilium/config-map
         - --debug=$(CILIUM_DEBUG)

renovate Bot requested a review from anthr76 as a code owner July 16, 2026 19:54

renovate Bot added renovate/helm type/patch labels Jul 16, 2026

pull-request-size Bot added the size/XS label Jul 16, 2026

fix(helm): update chart cilium ( 1.19.5 ➔ 1.19.6 )

67b0ed5

renovate Bot force-pushed the renovate/cilium-1.x branch from 9985df9 to 67b0ed5 Compare July 20, 2026 21:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(helm): update chart cilium ( 1.19.5 ➔ 1.19.6 ) - #3262

fix(helm): update chart cilium ( 1.19.5 ➔ 1.19.6 )#3262
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cilium-1.x

renovate Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.19.6: 1.19.6

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

Configuration

Uh oh!

github-actions Bot commented Jul 16, 2026

qgr1-cluster-0 - kustomization

Uh oh!

github-actions Bot commented Jul 16, 2026

qgr1-cluster-0 - helmrelease

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 16, 2026 •

edited

Loading

`v1.19.6`: 1.19.6