Cilium
v1.19.5Networking & MessagingCilium v1.19.5 is a bugfix-heavy patch release addressing policy enforcement bugs, Gateway API panics, and load-balancer correctness issues. No CVEs, but several fixes warrant attention before upgrading.
breakingMigrate away from `l2podAnnouncements.interface` Helm value before upgrading
The `l2podAnnouncements.interface` Helm key was removed because it wrote a configmap entry the agent no longer reads, causing crash-loops when L2 pod announcements are enabled. Before upgrading, check your Helm values for this key and replace it with `l2podAnnouncements.interfacePattern`. Clusters using the old key will fail to start after the upgrade.
breakingCheck CiliumEgressGatewayPolicy if you use NamespaceSelector
A bug caused the NamespaceSelector field in CiliumEgressGatewayPolicy to be silently corrupted, making those rules ineffective. After upgrading to 1.19.5, verify that egress policies with NamespaceSelector are actually being enforced — traffic that was previously leaking may now be blocked.
enhancementVerify ipBlock network policies if you rely on selectorless rules
A bypass was fixed where wildcard namespace selectors could skip ipBlock rules without a pod selector. If you have CiliumNetworkPolicies using ipBlock without explicit namespace selectors, review them post-upgrade to confirm enforcement behavior matches your intent — the fix may change observed traffic patterns.
Key changes (5)
- Fixed wildcard namespace bypass for selectorless ipBlock rules — network policy was not enforced correctly in some cases
- Removed defunct `l2podAnnouncements.interface` Helm value; clusters using it will crash-loop unless migrated to `interfacePattern`
- Fixed CiliumEgressGatewayPolicy NamespaceSelector corruption that silently rendered egress policies ineffective
- Fixed node connectivity disruption when ClusterIP/LoadBalancer VIPs overlapped with node-local IPs
- Load-balancing backend internals refactored to handle thousands of services sharing a backend without performance degradation