Cilium
v1.18.11Networking & MessagingCilium 1.18.11 is a patch release focused on stability, fixing memory leaks, socket handling crashes, and Gateway API routing bugs. No breaking changes; safe to adopt for teams running 1.18.x in production.
securityApply patch if you see agent crashes in socket handling
Cilium 1.18.11 fixes a nil pointer dereference in filterAndDestroySockets that could crash the agent. If you have seen sudden agent pod restarts or panic logs mentioning socket filtering, upgrade promptly. This is a stability issue that affects 1.18.10 and earlier.
breakingVerify MTU settings on non-Cilium interfaces after upgrade
1.18.11 changes MTU handling to skip interfaces not managed by Cilium. If your infrastructure depends on Cilium adjusting MTU on external interfaces (e.g., host-managed veth pairs), test this upgrade in a staging environment first. Mark interfaces with altname to ensure they are recognized as Cilium-owned; otherwise, MTU will not be modified.
enhancementAdopt if running Kubernetes Gateway API with TLS routes
This patch fixes two distinct bugs in Gateway API support: weighted backend routing for TLSRoute passthrough and mixed listener handling. If you use Gateway API with TLS termination or passthrough, this upgrade eliminates silent routing failures. No configuration changes needed; test existing Gateway API resources in a staging cluster first.
Key changes (5)
- Fixed memory leak in StateDB watch channel hash map reuse for large transactions
- Corrected weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API
- Fixed nil pointer dereference in socket filtering code that could crash the agent
- Fixed MTU change behavior to only affect Cilium-managed interfaces, skipping others
- Improved troubleshoot commands to report more kvstore and clustermesh diagnostic data