RATATOSKRATATOSK
Sign in

Cilium

v1.19.0Networking & Messaging
Feb 4, 2026

CHECK 3PLAN 2OTHER 28

Cilium v1.19.0 expands networking, encryption, observability, operations, and performance capabilities. It also changes defaults and constraints, deprecates selected policy fields, and removes the older `CiliumBGPPeeringPolicy` v1 API.

Check if affected (3)

  • breakingLocal-cluster default for network policy selectors

    Applies if you use network policy selectors that do not explicitly define a cluster.

    Network policy selectors without an explicitly defined cluster now allow communication only with the local cluster by default in v1.19.0.

  • breakingOut-of-band Mutual Authentication default

    Applies if you use the out-of-band Mutual Authentication feature.

    The out-of-band Mutual Authentication feature is disabled by default in v1.19.0.

  • breakingThe CiliumBGPPeeringPolicy v1 API, removed

    Applies if you use the older CiliumBGPPeeringPolicy v1 API.

    Support for the older CiliumBGPPeeringPolicy v1 API is removed in v1.19.0. It should be replaced with v2 APIs, including cilium.io/v2.

Plan ahead (2)

  • deprecatedKafka protocol match fields, deprecated

    Applies if you use Kafka protocol match fields in network policies.

    Kafka protocol match fields are deprecated in v1.19.0. The fields are beta features.

  • deprecatedToRequires and FromRequires policy fields, deprecated

    Applies if you use the ToRequires or FromRequires policy fields.

    The ToRequires and FromRequires policy fields are deprecated in v1.19.0.

All 28 other recorded changesadditions 16 · constraints 7 · value changes 5

additions (16)

  • DNS Policies match pattern now support a wildcard prefix(***.*) to match multilevel subdomain as pattern prefix.
  • When Network Policies deny a connection, Cilium can return ICMPv4 "Destination unreachable" messages for a friendlier deny.
  • Both IPsec and WireGuard transparent encryption modes now support a "strict mode" to require traffic to be encrypted between nodes.
  • You can enroll namespaces into Ztunnel, which enables TCP connections between workloads to be transparently encrypted and authenticated.
  • Leverage upcoming Linux support for BIG TCP when communicating over UDP-based tunnels such as VXLAN and Geneve.
  • Detect maximum transmission unit (MTU) sizes for network paths using TCP.
  • addresses in IPAM pools can be excluded from masquerade
  • There's a new Interface BGP advertisement type that allows advertisement of IPs assigned on local interfaces.
  • You can override the auto-generated BGP session source IP with the IP address applied on the configured sourceInterface
  • Optionally withdraw BGP routes when a service has 0 endpoints
  • Configure Cilium and Hubble to trace specific packets through the cluster using IP Options.
  • Filter flows when using the hubble command line to understand the encryption status of the traffic, either --encrypted or --unencrypted.
  • Helm charts are also available under
  • Add TLS/mTLS support for Prometheus metrics exposed by the Cilium Operator.
  • There's now support for auto-installing the Custom Resource Definitions (CRDs) for Multi-Cluster Services (MCS).
  • Streamline Cluster Mesh and Hubble certificate generation when using GitOps approaches.

constraints (7)

  • You can now match VRRP and IGMP protocols in host firewall rules.
  • The IPsec encryption mode now supports BPF Host Routing for faster route lookups
  • You can now choose IPv6 for the tunnel underlay address family on dual-stack clusters.
  • IP Masquerade configuration can now be customized for traffic sent to nodes in other IP subnets
  • Add support for Neighbor Discovery Advertisements for IPv6 Layer-2 Announcements.
  • Pods can now connect to themselves via a Kubernetes "loopback service" using IPv6.
  • Cilium's GAMMA support now includes support for using GRPCRoute as well as HTTPRoute.

value changes (5)

  • promote it from Beta to Stable.
  • Hubble v1.Events drop messages now include which Network Policy caused the drop.
  • Improve Cilium resource usage for handling selectors in network policies.
  • Several improvements have been made to reduce the number of connections being tracked by Cilium, particularly when using Geneve, VXLAN or WireGuard.
  • Reduce memory usage for cilium-operator in large AWS environments with many resources.
Add Cilium to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Cilium releases →