Cilium Releases

GET https://watchchangelog.com/api/v1/entries?source=cilium.releases

{
  "source": "cilium.releases",
  "vendor": "CNCF",
  "id": "tag:github.com,2008:Repository/48109239/v1.20.1",
  "published_at": "2026-08-18T10:36:16.000Z",
  "title": "1.20.1",
  "url": "https://github.com/cilium/cilium/releases/tag/v1.20.1",
  "summary": "Summary of Changes Major Changes: docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #47615 , Upstream PR #47351 , @MrFreezeex ) Minor Changes: envoy: demote stale ADS endpoint warning (Backport PR #47805 , Upstream PR #47148 , @nezdolik ) Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #47881 , Upstream PR #47529 , @julianwiedmann ) Bugfixes: azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #47690 , Upstream PR #47449 , @jaredledvina ) bpf: dsr: don't look for TCP header on fragmented packets (Backport PR #47881 , Upstream PR #47640 , @julianwiedmann ) bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47621 , Upstream PR #47343 , @smagnani96 ) clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #47885 , Upstream PR #47824 , @MrFreezeex ) datapath: turn ARP off on the base devices before bringing them up (Backport PR #47885 , Upstream PR #47838 , @aanm ) endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #47690 , Upstream PR #47625 , @christarazi ) endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #47954 , Upstream PR #47880 , @weizhoublue ) envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #47885 , Upstream PR #47741 , @jdw6359 ) envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47690 , Upstream PR #47583 , @aanm ) Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47805 , Upstream PR #47765 , @julianwiedmann ) Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #47967 , Upstream PR #47802 , @bimmlerd ) Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #47805 , Upstream PR #47727 , @aanm ) Fix a spurious \"unable to find ifindex for interface MAC\" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47690 , Upstream PR #47295 , @aanm ) Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47690 , Upstream PR #47552 , @haozhangami ) Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #47881 , Upstream PR #47593 , @julianwiedmann ) fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR #47885 , Upstream PR #47754 , @weizhoublue ) Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #47690 , Upstream PR #46842 , @pidreher ) gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR #47954 , Upstream PR #47840 , @mhofstetter ) gateway-api: mark unresolved backend service ports in route status (Backport PR #47885 , Upstream PR #47766 , @mhofstetter ) gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR #47690 , Upstream PR #46696 , @thorn3r ) gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR #47690 , Upstream PR #47457 , @asauber ) gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR #47805 , Upstream PR #47702 , @mhofstetter ) gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR #47690 , Upstream PR #47627 , @mhofstetter ) ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47885 , Upstream PR #47208 , @iwanhae ) l2announcer: re-evaluate services on frontend changes (Backport PR #47690 , Upstream PR #47579 , @mhofstetter ) Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #47954 , Upstream PR #47826 , @mehrdadbn9 ) operator: Emit startup logs in the configured log format (Backport PR #47954 , Upstream PR #47890 , @HadrienPatte ) Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47885 , Upstream PR #47844 , @bimmlerd ) standalone-dns-proxy: return an error when no endpoint is found (Backport PR #47954 , Upstream PR #47791 , @vipul-21 ) wireguard: Unsubscribe node handler on shutdown (Backport PR #47805 , Upstream PR #47614 , @HadrienPatte ) CI Changes: .github: add python3-scapy for BPF unit tests (Backport PR #47690 , Upstream PR #47535 , @msune ) .github: run all quarantined EKS tests in a single tolerated step (Backport PR #47690 , Upstream PR #47534 , @aanm ) .github: Run envoy image check against PR content (Backport PR #47805 , Upstream PR #47792 , @joestringer ) .github: Simplify permissions for image linter workflow (Backport PR #47805 , Upstream PR #47753 , @joestringer ) .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #47690 , Upstream PR #47470 , @atykhyy ) .github: test the default ENI behaviour on the EKS pull request leg (Backport PR #47690 , Upstream PR #47569 , @aanm ) ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #47805 , Upstream PR #47743 , @giorio94 ) bpf/complexity-tests: Cover L7 LB (Backport PR #47805 , Upstream PR #47060 , @pchaigno ) ci: build race images on push events so conformance-race works on stable branches (Backport PR #47609 , Upstream PR #47608 , @aanm ) ci: build race images on push in the stable image builders (Backport PR #47609 , Upstream PR #47616 , @aanm ) ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47805 , Upstream PR #47364 , @mhofstetter ) ci: fix filtering out md files in bpf checks (Backport PR #47690 , Upstream PR #47605 , @nebril ) ci: migrate set-commit-status to cilium/actions (Backport PR #47805 , Upstream PR #47771 , @bogdankrasko ) ci: skip etcd log fetch when kvstore was never started (Backport PR #47885 , Upstream PR #47801 , @aanm ) Fix missing events_map_rate_limit complexity coverage (Backport PR #47805 , Upstream PR #47691 , @pchaigno ) gha/kubespray: run on schedule, rather than on every push (Backport PR #47731 , Upstream PR #47719 , @giorio94 ) gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47731 , Upstream PR #47703 , @giorio94 ) gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47731 , Upstream PR #47717 , @giorio94 ) gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR #47731 , Upstream PR #47724 , @giorio94 ) images/scripts: Validate Envoy image vars against sed injection (Backport PR #47805 , Upstream PR #47205 , @MasloMaslane ) Revert \"gha: don't install LLVM and Clang in integration tests workflow\" (Backport PR #47885 , Upstream PR #47780 , @giorio94 ) test(bpf): parallelize eBPF test compilation (Backport PR #47954 , Upstream PR #47426 , @lconnery ) test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47805 , Upstream PR #47725 , @aanm ) test: allowlist the leader election read timeout in ginkgo log check (Backport PR #47690 , Upstream PR #47612 , @aanm ) Misc Changes: Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR #47690 , Upstream PR #46116 , @amaanx86 ) allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47690 , Upstream PR #47455 , @giorio94 ) bpf/nat: Move IPv6 nat entry to map (Backport PR #47805 , Upstream PR #47762 , @pchaigno ) bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR #47805 , Upstream PR #47582 , @dylandreimerink ) bpf: dsr: only require DSR-info on SYN packet (Backport PR #47881 , Upstream PR #47592 , @julianwiedmann ) bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR #47881 , Upstream PR #47388 , @julianwiedmann ) bpf: lb: use dedicated new_backend bool (Backport PR #47881 , Upstream PR #47841 , @julianwiedmann ) chore(deps): update all github action dependencies (v1.20) ( #47991 , @cilium-renovate[bot]) chore(deps): update all github action dependencies (v1.20) ( #48008 , @cilium-renovate[bot]) chore(deps): update all-dependencies (v1.20) ( #47678 , @cilium-renovate[bot]) chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ( #47576 , @cilium-renovate[bot]) chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ( #47988 , @cilium-renovate[bot]) chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) ( #47949 , @cilium-renovate[bot]) chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) ( #47864 , @cilium-renovate[bot]) chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ( #47899 , @cilium-renovate[bot]) chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ( #47989 , @cilium-renovate[bot]) chore(deps): update stable lvh-images (v1.20) (patch) ( #47865 , @cilium-renovate[bot]) chore(deps): update stable lvh-images (v1.20) (patch) ( #47990 , @cilium-renovate[bot]) clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR #47962 , Upstream PR #47932 , @giorio94 ) docs: clarify GAMMA DROP_EP_NOT_READY events (Backport PR #47885 , Upstream PR #47587 , @thorn3r ) docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR #47690 , Upstream PR #47600 , @41ks ) docs: Remove \"not stable\" installation instructions (Backport PR #47798 , Upstream PR #47646 , @joestringer ) docs: update Gateway API conformance badge (Backport PR #47690 , Upstream PR #47581 , @arybolovlev ) docs: Update Gateway API installation guide (Backport PR #47690 , Upstream PR #47446 , @arybolovlev ) Gateway API: the Gateway address status no longer reports a bogus \"\" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR #47690 , Upstream PR #47466 , @locker95 ) gateway-api: remove unnecessary TLSRoute support checks (Backport PR #47885 , Upstream PR #47758 , @mhofstetter ) gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR #47690 , Upstream PR #47599 , @mhofstetter ) gateway-api: return route check errors directly (Backport PR #47805 , Upstream PR #47607 , @mhofstetter ) gateway-api: unify Gateway API listener parentRef matching (Backport PR #47690 , Upstream PR #46670 , @arybolovlev ) gateway-api: validate gRPCRoute header modifiers in status (Backport PR #47805 , Upstream PR #47606 , @mhofstetter ) operator: Replace reflect.DeepEqual with assert.Equal in tests (Backport PR #47690 , Upstream PR #47424 , @HadrienPatte ) Update all github action dependencies (v1.20) ( #47656 , @cilium-renovate[bot]) Update all github action dependencies (v1.20) ( #47675 , @cilium-renovate[bot]) Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) ( #47655 , @cilium-renovate[bot]) Update documentation dependencies (Backport PR #47798 , Upstream PR #47750 , @joestringer ) Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ( #47657 , @cilium-renovate[bot]) Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ( #47659 , @cilium-renovate[bot]) Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ( #47658 , @cilium-renovate[bot]) Other Changes: install: Update image digests for v1.20.0 ( #47584 , @cilium-release-bot[bot]) Docker Manifests cilium quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b clustermesh-apiserver quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5 quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5 hubble-relay quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4 quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4 operator-alibabacloud quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c operator-aws quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7 quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7 operator-azure quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031 quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031 operator-generic quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf operator quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d",
  "tags": [
    "CNCF",
    "cilium.releases",
    "networking",
    "kubernetes",
    "ebpf"
  ]
}