Cilium
v1.19.6Networking & MessagingCilium v1.19.6 is a routine patch fixing multiple regressions in ClusterMesh affinity handling and host firewall configuration, along with policy and gateway-api issues. A minor gateway-api telemetry feature and dependency updates are included.
breakingClusterMesh affinity annotation traffic blackhole fixed
When using the service.cilium.io/affinity: "none" annotation in ClusterMesh, all remote backends were incorrectly dropped if no local endpoints exist, causing a traffic blackhole. The fix ships in v1.19.6 and matters if ClusterMesh services rely on this annotation to manage traffic distribution across clusters.
breakingHost firewall disabled-state configuration sync fixed
Disabling hostFirewall.enabled via Helm (toggling from true to false) left the host firewall in the live ConfigMap in enabled state, causing the firewall rules to remain active despite the configuration change. The fix ships in v1.19.6 and applies when toggling the host firewall setting.
Key changes (6)
- ClusterMesh traffic blackhole when using service.cilium.io/affinity: "none" with no local endpoints fixed
- Host firewall remained enabled in live ConfigMap after Helm disablement fixed
- Policy denial regressions for L7 load-balanced services and pod network policy restoration during agent restart addressed
- Stale hostport entries and gateway-api port listener assignment bugs corrected
- Gateway-api adds configurable access logs via spec.telemetry.accessLogs in CiliumGatewayClassConfig
- cilium/ebpf upgraded to v0.22.0; statedb bumped to v0.5.9