Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: CiliumClear ×

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
Explicit tbid traffic is prevented from leaking to the host network namespace.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
The Docker libnetwork plugin is sunset and is no longer available in this release.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
The deprecated ces-slice-mode option is removed in this release.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
Cilium's Beta Mutual Auth support is deprecated and will be removed in a future version.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
The previous per-address addresses[].subnet and flat interfaces[].cidr fields are deprecated.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
The local REST BGP APIs are deprecated and will be removed in the future.
+ 3 more on the release page

Source ↗

Ciliumv1.19.6Networking & MessagingJul 16, 2026

CHECK 1OTHER 46View full analysis

A maintenance release with numerous correctness fixes, Gateway API and telemetry additions, dependency and image updates, and internal behavior changes. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingHelm handling of hostFirewall.enabled disablement
Applies when you use Helm to disable hostFirewall.enabled, toggling it from true to false.
Helm now updates the live ConfigMap correctly when hostFirewall.enabled changes from true to false. This correctness fix ships in v1.19.6.

Source ↗

Ciliumv1.19.5Networking & MessagingJun 16, 2026

CHECK 3OTHER 48View full analysis

A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.

Check if affected (3)

securityWildcard namespace bypass for selectorless ipBlock rules, fixed
Applies if you configure ipBlock.
The wildcard namespace bypass is fixed for selectorless ipBlock rules.
breakingThe loadBalancer.standalone Helm option, removed
Applies if you configure loadBalancer.standalone.
The Helm loadBalancer.standalone option is removed from the release.
breakingThe l2podAnnouncements.interface Helm value, replaced by l2podAnnouncements.interfacePattern
Applies if you configure l2podAnnouncements.interface and enable L2 pod announcements.
The defunct Helm value l2podAnnouncements.interface is removed because it rendered a ConfigMap key the agent no longer recognizes and could cause crash loops. l2podAnnouncements.interfacePattern is the replacement.

Source ↗

Ciliumv1.19.4Networking & MessagingMay 13, 2026

ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

securityThe github.com/moby/spdystream module update
The github.com/moby/spdystream module is updated to v0.5.1.
breakingService-label filtering for EndpointSlice watches
The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

breakingLabel filtering for EndpointSlices
Applies if you set --k8s-service-proxy-name.
When --k8s-service-proxy-name is set, EndpointSlices are filtered at the watch level by the service.kubernetes.io/service-proxy-name label, matching the existing Services filtering. Operators that manage EndpointSlices themselves must add the matching label to those slices.

Source ↗

Ciliumv1.17.16Networking & MessagingMay 13, 2026

ACTION 1CHECK 1OTHER 23View full analysis

A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.

Action needed (1)

securityThe github.com/moby/spdystream dependency update
The github.com/moby/spdystream module is updated to v0.5.1 in v1.17.16.

Check if affected (1)

breakingCiliumLocalRedirectPolicy addressMatcher override behavior
Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.
In v1.17.16, CiliumLocalRedirectPolicy addressMatcher refuses to override an existing Service frontend. Set --enable-lrp-address-matcher-override=true to restore the legacy behavior.

Source ↗

Ciliumv1.18.7Networking & MessagingFeb 13, 2026

ACTION 1OTHER 27View full analysis

A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingExclusion of topology.kubernetes.io labels from security labels by default
The default security-label handling in this release excludes topology.kubernetes.io labels from security labels.

Source ↗

Ciliumv1.19.0Networking & MessagingFeb 4, 2026

ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

securityThe github.com/containerd/containerd dependency, updated
The github.com/containerd/containerd module is updated to v1.7.29.
securityThe github.com/go-viper/mapstructure/v2 dependency, updated
The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker module is updated to v28.3.3+incompatible.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto module is updated to v0.45.0.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.4
The helm.sh/helm/v3 module is updated to v3.18.4.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.5
The helm.sh/helm/v3 module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.

Check if affected (30)

breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
Network policy selectors without an explicit cluster now allow communication only with the local cluster by default.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
Support for the older CiliumBGPPeeringPolicy v1 API is removed. BGP configuration uses the cilium.io/v2 APIs instead.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
The out-of-band Mutual Authentication feature is disabled by default pending community feedback.
+ 27 more on the release page

Plan ahead (7)

deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
The special IPsec mode for enabling encrypted overlay with Multicast, configured by --enable-ipsec-encrypted-overlay, is deprecated and will be removed in a future release.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
Kafka protocol match fields (beta), along with the ToRequires and FromRequires policy fields, are deprecated.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
Passing TLS certificates and keys in Helm values is deprecated.
+ 4 more on the release page

Source ↗

Ciliumv1.18.6Networking & MessagingJan 13, 2026

ACTION 1OTHER 21View full analysis

A maintenance release with fixes for networking, policy, proxy, gateway API, and endpoint handling, plus dependency, image, and OCI publishing updates. The Cilium Preflight check no longer includes Envoy Configmaps.

Action needed (1)

breakingCilium Preflight check no longer includes Envoy Configmaps
The Cilium Preflight check no longer includes Envoy Configmaps. This change ships in v1.18.6.

Source ↗

Browse by month