What cilium/cilium shipped
Written by FoxPlug from public releases; not affiliated with Cilium. An automatic summary of the public release, pull request and commit data of github.com/cilium/cilium. Cilium did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Fixed Envoy xDS listener handling bugs that prevented restoration from completing, preserved dynamically allocated proxy ports during address changes, and scoped ADS rollback correctly. Pull request #48897
- Fixed incorrect endpoint manager garbage collection handling that could delete new endpoints when reusing IDs from previously garbage-collected endpoints. Pull request #48905
- Fixed cilium-cli validation to respect --ip-families flag, preventing setup timeouts when validating unreachable IPv6 NodePort addresses on IPv4-only clusters. Pull request #45325
- Reduced Envoy network policy update memory allocations by approximately 40% and overall memory consumption by 10-20%. Pull request #48925
- Fixed UDP connection handling in load balancing to prevent draining terminating backends, which was causing UDP datagrams to be incorrectly routed after backend termination. Pull request #48715
- Migrated IPAMStatus.AssignedStaticIP field and related functions to netip types for better type safety. Pull request #48971
- Moved echo-b connectivity check service from NodePort 31414 to 30014 to avoid conflicts with Kubernetes automatic port allocation. Pull request #48926
- Fixed node neighbor discovery delete queries to use consistent owner ID format, preventing stale forwardable-ip entries from leaking when nodes are deleted. Pull request #48871
- Exposed Hubble Relay startup as reusable building blocks for downstream binaries to construct custom Relay deployments. Pull request #48461
- Optimized FQDN zombie name storage from O(n²) slice-based operations to set-based operations for better performance with large name collections. Pull request #48360
Why it matters
This week includes critical fixes for endpoint management, load balancing edge cases, and network policy performance. Multiple backports ensure stability across recent release branches, while infrastructure improvements address flaky tests and resource constraints in CI.
Changelog entry
- Fixed Envoy xDS listener handling bugs that blocked restoration and lost dynamically allocated proxy ports during address changes Pull request #48897
- Fixed endpoint manager garbage collection race that could delete new endpoints when reusing IDs Pull request #48905
- Fixed cilium-cli to respect --ip-families flag in validation checks Pull request #45325
- Reduced Envoy network policy update memory allocations by ~40% Pull request #48925
- Fixed UDP load balancing to not drain terminating backends Pull request #48715
- Migrated IPAM to use netip.Addr types for better type safety Pull request #48971
- Moved echo-b connectivity check service to avoid NodePort conflicts Pull request #48926
- Fixed node neighbor discovery delete queries to prevent stale entries Pull request #48871
This week: fixed endpoint GC bugs, improved Envoy listener handling, reduced policy update memory by 40%, fixed UDP draining in load balancing, and optimized FQDN operations.
Cilium shipped important fixes this week: corrected endpoint garbage collection to prevent accidental deletion of reused endpoint IDs, fixed Envoy xDS listener restoration and port preservation during address changes, reduced network policy update memory usage by 40%, fixed UDP load balancing to prevent incorrect draining of terminating backends, and optimized FQDN zombie name handling. Multiple stability backports ensure consistency across release branches.
Week of September 14, 2026
What shipped
- Released version 1.20.2 with a fix for AWS IPAM operator trying to release prefix IPs as individual IPs when still in use, and added node label selector support for gateway-api when hostNetwork is enabled. Release
- Released version 1.19.8 with fixes for AWS IPAM prefix delegation on subnets that ran out of prefixes and agent crashes when dumping map events. Release
- Released version 1.18.14 with fixes for AWS IPAM prefix delegation allocation failures and agent crashes when dumping map events. Release
- Fixed unloading DNS policies on shutdown where endpoints would timeout waiting for policy computation that was never requested. Pull request #48747
- Fixed cilium-operator metrics list to support both IPv4 and IPv6 loopback addresses, allowing it to work in IPv6-only mode on dual-stack nodes. Pull request #48780
- Fixed restoration of terminating load-balancing backends on restart to properly distinguish between quarantine states from termination versus health-check failures. Pull request #48763
- Fixed MCS EndpointSlice mirroring to handle service names that exceed 63 characters. Pull request #48783
- Fixed operator to shut down when the controller-runtime manager fails instead of silently continuing. Pull request #48385
- Fixed Envoy policy tier rendering to correctly include port-specific Pass rules when a tier contains a wildcard port rule. Pull request #48854
- Fixed validation of LocalRedirectPolicy to reject policies with empty redirectBackend.toPorts array to prevent agent panic. Pull request #48491
Why it matters
Three patch releases were published addressing AWS IPAM issues affecting production deployments, along with critical fixes for DNS policy handling, operator reliability, and networking edge cases. These fixes improve stability in dual-stack environments and cloud deployments where Cilium is commonly used.
Changelog entry
- gateway-api: node label selector for when hostNetwork is enabled Release
- aws/ipam: Fixed operator trying to release prefix IPs as individual IPs when in use Release
- aws/ipam: Fixed operator failing to allocate IPs on subnets that ran out of prefixes with prefix delegation enabled Release
- bpf: Fixed agent crash when dumping map events Release
- daemon: Fixed unloading DNS policies on shutdown to properly request policy computation Pull request #48747
- operator: Fixed metrics list to try both IPv4 and IPv6 loopback addresses Pull request #48780
- loadbalancer: Fixed restoration of terminating backends on restart Pull request #48763
- k8s: Fixed MCS EndpointSlice mirroring with service names exceeding 63 characters Pull request #48783
- operator: Fixed shutdown when controller-runtime manager fails Pull request #48385
- envoy: Fixed policy tier rendering for port-specific Pass rules Pull request #48854
- k8s: Added validation to reject LocalRedirectPolicy with empty redirectBackend.toPorts Pull request #48491
v1.20.2, v1.19.8, and v1.18.14 released. Fixes for AWS IPAM prefix delegation, DNS policy shutdown, operator crashes, IPv6-only mode support, and Envoy policy tiers.
Cilium releases v1.20.2, v1.19.8, and v1.18.14 now available. Key fixes include: AWS IPAM prefix delegation on exhausted subnets, DNS policy unloading on shutdown, operator reliability improvements, IPv6-only mode support for dual-stack nodes, and Envoy policy tier rendering with port-specific rules. These updates address stability issues in production cloud deployments and improve dual-stack networking support.