Update module github.com/cilium/cilium to v1.18.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cilium/cilium	v1.18.2 -> v1.18.3

---

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.18.3: 1.18.3

Compare Source

Summary of Changes

ℹ️ The images in this release were signed with cosign v3. Please use cosign v3 tooling to validate signatures with the following command syntax:

cosign verify --certificate-github-workflow-repository cilium/cilium --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-github-workflow-name 'Image Release Build' --certificate-github-workflow-ref refs/tags/v1.18.3 --certificate-identity https://github.com/cilium/cilium/.github/workflows/build-images-releases.yaml@refs/tags/v1.18.3 quay.io/cilium/operator-aws:v1.18.3 | jq -r '.[].critical.image'

Minor Changes:

• Fix a complexity issue for the bpf_xdp program (Backport PR #​42198, Upstream PR #​42193, @​aspsk)
• hubble: mark kafka l7 visibility as deprecated (Backport PR #​41968, Upstream PR #​41072, @​kaworu)

Bugfixes:

• add the port name for address based LRP so frontend can pick the right backend (Backport PR #​41828, Upstream PR #​41602, @​liyihuang)
• Avoid scenario where ENI device configuration can be skipped. (Backport PR #​41968, Upstream PR #​41760, @​jasonaliyetti)
• Cilium now configures Envoy to allow websocket connections to be passed through with HTTP policies. (Backport PR #​41828, Upstream PR #​41729, @​jrajahalme)
• Fix a bug that was preventing Cilium to delete stale pod CIDRs routes when changing routing mode to native (Backport PR #​41968, Upstream PR #​41819, @​pippolo84)
• Fix a fatal error when accessing multicast map using cilium-dbg bpf multicast (Backport PR #​42151, Upstream PR #​42080, @​tklauser)
• Fix BGP auto discovery not sending community info (Backport PR #​41968, Upstream PR #​41920, @​jiashengz)
• Fix bug in ENI routing where Cilium would chose the wrong subnet for routing traffic on secondary interfaces (Backport PR #​41828, Upstream PR #​40860, @​liyihuang)
• Fix bug that could cause ICMP error packets to have an incorrect inner IP checksum when KPR is enabled. (Backport PR #​41828, Upstream PR #​41551, @​yushoyamaguchi)
• Fix bug with delegated IPAM where IPv6 traffic was routed via the wrong interface (Backport PR #​41968, Upstream PR #​41598, @​NihaNallappagari)
• Fix failing node health check on dual stack cluster if NodeInternalIPs are not configured for both families. (Backport PR #​42055, Upstream PR #​41633, @​Dennor)
• Fix increase in memory usage when service names are looked up at high rate during Hubble flow creation (Backport PR #​42151, Upstream PR #​41965, @​joamaki)
• Fix panic at startup in IPsec subsystem with Multi-Pool IPAM mode (#​41725, @​pippolo84)
• Fix race condition preventing the skiplbmap BPF map from sometimes being pruned after restart. (Backport PR #​41828, Upstream PR #​41529, @​joamaki)
• Fixes a rare bug where endpoints may have incomplete policies in large clusters. (Backport PR #​42151, Upstream PR #​42049, @​squeed)
• hostfw: also exclude non-transparent proxy traffic when BPF masq is enabled (Backport PR #​41989, Upstream PR #​41915, @​julianwiedmann)
• Ignore expected error in neighbor reconciliation (Backport PR #​41968, Upstream PR #​41815, @​dylandreimerink)
• loadbalancer: allow HostPort for multiple protos on same port (Backport PR #​41913, Upstream PR #​41521, @​bersoare)
• operator/pkg/lbipam: fix LoadBalancerIPPool conditions update logic (Backport PR #​41828, Upstream PR #​41322, @​alimehrabikoshki)

CI Changes:

• .actions/cilium-config: add missing extraEnv in GH action (Backport PR #​41828, Upstream PR #​41420, @​aanm)
• .github/workflows: add variable for renovate bot username (Backport PR #​41843, Upstream PR #​41818, @​aanm)
• .github/workflows: automatically add /test for renovate PRs (Backport PR #​41843, Upstream PR #​41770, @​aanm)
• .github/workflows: do not wait on linters form forks (Backport PR #​41828, Upstream PR #​41822, @​aanm)
• .github/workflows: remove reviewers requested by auto-committer[bot] (Backport PR #​41828, Upstream PR #​41759, @​aanm)
• cli: Fix unreliable tests due to error emitted in Cilium logs "retrieving device lxc*: Link not found" (Backport PR #​42200, Upstream PR #​42146, @​fristonio)
• gha: Correct k8s version for f12-datapath-service-ns-misc (Backport PR #​41756, Upstream PR #​41753, @​sayboras)
• ginkgo: add test ownership for ginkgo tests (Backport PR #​42055, Upstream PR #​41950, @​aanm)
• Streamline ci-multi-pool workflow (Backport PR #​41631, Upstream PR #​40658, @​pippolo84)
• workflows: fix GCP OIDC authentication's project ID (#​42173, @​nbusseneau)

Misc Changes:

• .github/workflows: stop build CI images until base images are built (Backport PR #​41828, Upstream PR #​41681, @​aanm)
• agent: Add Cilium health config cell (Backport PR #​42055, Upstream PR #​41627, @​aditighag)
• bpf/nat: Move ipv6_nat_entry to map (Backport PR #​41968, Upstream PR #​41902, @​pchaigno)
• bpf: hostfw: have from-host always pass the ipcache-based src identity (Backport PR #​42113, Upstream PR #​42093, @​julianwiedmann)
• bpf: Only send fillup signal to agent on ENOMEM error (Backport PR #​41968, Upstream PR #​41864, @​borkmann)
• chore(deps): update all github action dependencies (v1.18) (#​41795, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​41931, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​42028, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​42136, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​42264, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​41716, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​41793, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​42035, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​42116, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.27 (v1.18) (#​42263, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33 (v1.18) (#​42265, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.7 docker digest to 2c5f7a0 (v1.18) (#​42026, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.7 docker digest to 87916ac (v1.18) (#​41792, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.9 docker digest to 02ce1d7 (v1.18) (#​42253, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.8 (v1.18) (#​42062, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.9 (v1.18) (#​42166, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.7-1759058812-49b096a457d6e7f6d650229cbf95c63d59759331 (v1.18) (#​41933, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​41730, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​41794, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​41930, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​42027, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​42135, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​42300, @​cilium-renovate[bot])
• doc: add note on hostfw and ipsec interaction (Backport PR #​41968, Upstream PR #​41810, @​darox)
• docs/dsr: Remove IPIP example configuration (Backport PR #​41828, Upstream PR #​41701, @​pchaigno)
• docs: Clarify list of capabilities in threat model (Backport PR #​41828, Upstream PR #​41682, @​joestringer)
• docs: fix broken Chainguard SBOM link (Backport PR #​41828, Upstream PR #​41719, @​yashisrani)
• docs: remove stale kernel requirements (Backport PR #​42151, Upstream PR #​42081, @​julianwiedmann)
• docs: Update iproute2 compile steps in reference guide. (Backport PR #​41828, Upstream PR #​41638, @​dkanaliev)
• endpoint: reduce missed-policy-update log severity for restoring eps (Backport PR #​42055, Upstream PR #​41095, @​fristonio)
• endpointsynchronizer: suppress warning log when endpoint is terminating (Backport PR #​41828, Upstream PR #​41755, @​giorio94)
• gateway-api: Fix incorrect Owns call in refactor (Backport PR #​41968, Upstream PR #​41807, @​youngnick)
• hubble: allow overrrides if building from outside the tree (Backport PR #​41828, Upstream PR #​41726, @​tklauser)
• ipsec: add support for using remote PodCIDR entries (Backport PR #​42073, Upstream PR #​41519, @​julianwiedmann)
• Make kubeProxyReplacement available in the reference and documentation (Backport PR #​41968, Upstream PR #​41535, @​liyihuang)
• redirectpolicy: Always OpenOrCreate SkipLB map to avoid loader race (Backport PR #​41968, Upstream PR #​41707, @​joamaki)
• redirectpolicy: Fix comparison of BackendParams (Backport PR #​41848, Upstream PR #​41705, @​joamaki)
• Remove kiam documentation from Local Redirect Policy (Backport PR #​41968, Upstream PR #​41644, @​liyihuang)
• Update checkpatch and startup-script image digest (Backport PR #​41828, Upstream PR #​41710, @​HadrienPatte)

Other Changes:

• [v1.18] gateway-api: Refactor Gateway API reconciler (#​41720, @​youngnick)
• [v1.18] workflows/release: add secrets for step 4 and 5 (#​41733, @​jrajahalme)
• install: Update image digests for v1.18.2 (#​41722, @​cilium-release-bot[bot])
• proxy: Bump cilium-envoy to 1.34.10 (#​42251, @​sayboras)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.3@​sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
quay.io/cilium/cilium:stable@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.3@​sha256:0d15efc992a85003759232598bf05fb1a4cd3c9fa28fb96bee1789ffe27cc50d
quay.io/cilium/clustermesh-apiserver:stable@sha256:0d15efc992a85003759232598bf05fb1a4cd3c9fa28fb96bee1789ffe27cc50d

docker-plugin

quay.io/cilium/docker-plugin:v1.18.3@​sha256:996d9fa5747175b1806ce01dd90dc586a5f52a32b7da409937a1f42714827d67
quay.io/cilium/docker-plugin:stable@sha256:996d9fa5747175b1806ce01dd90dc586a5f52a32b7da409937a1f42714827d67

hubble-relay

quay.io/cilium/hubble-relay:v1.18.3@​sha256:e53e00c47fe4ffb9c086bad0c1c77f23cb968be4385881160683d9e15aa34dc3
quay.io/cilium/hubble-relay:stable@sha256:e53e00c47fe4ffb9c086bad0c1c77f23cb968be4385881160683d9e15aa34dc3

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.3@​sha256:df8b6830ef0545199cffc5fb9fbf14c9dc8d92093b0e6355d8659705227f89ef
quay.io/cilium/operator-alibabacloud:stable@sha256:df8b6830ef0545199cffc5fb9fbf14c9dc8d92093b0e6355d8659705227f89ef

operator-aws

quay.io/cilium/operator-aws:v1.18.3@​sha256:ef39d61183b3bdf0e235650461b6c4d9ec7aa5f61a6c770f33c47a6bc5165e24
quay.io/cilium/operator-aws:stable@sha256:ef39d61183b3bdf0e235650461b6c4d9ec7aa5f61a6c770f33c47a6bc5165e24

operator-azure

quay.io/cilium/operator-azure:v1.18.3@​sha256:10a8a83ca6f0b02432c1ca0e67af98a48fdbefb684af44a399f58184ab174143
quay.io/cilium/operator-azure:stable@sha256:10a8a83ca6f0b02432c1ca0e67af98a48fdbefb684af44a399f58184ab174143

operator-generic

quay.io/cilium/operator-generic:v1.18.3@​sha256:b5a0138e1a38e4437c5215257ff4e35373619501f4877dbaf92c89ecfad81797
quay.io/cilium/operator-generic:stable@sha256:b5a0138e1a38e4437c5215257ff4e35373619501f4877dbaf92c89ecfad81797

operator

quay.io/cilium/operator:v1.18.3@​sha256:e350cea751afeae2f226a1bc275649c77a04a1e1ff50e61d782a371eae6fb2ff
quay.io/cilium/operator:stable@sha256:e350cea751afeae2f226a1bc275649c77a04a1e1ff50e61d782a371eae6fb2ff

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.72%. Comparing base (1931fc0) to head (97a21e2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #489      +/-   ##
==========================================
+ Coverage   72.03%   73.72%   +1.68%     
==========================================
  Files          19       19              
  Lines        3655     2835     -820     
==========================================
- Hits         2633     2090     -543     
+ Misses        781      504     -277     
  Partials      241      241              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.