chore(deps): update helm release cilium to v1.20.0

[renovate]

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	1.19.6 → 1.20.0

---

Release Notes

cilium/cilium (cilium)

v1.20.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Path: infra/cilium/helmrelease.yaml
Version: 1.19.6 -> 1.20.0

@@ -127,6 +127,10 @@
 bpf-lb-map-max: "65536"
 bpf-lb-external-clusterip: "false"
 bpf-lb-source-range-all-types: "false"
+ # When Gateway API is enabled this is forced to "true" so per-backend weights
+ # on TCPRoute/UDPRoute take effect (Maglev honors the LB algorithm annotation only
+ # when enabled). Paired with `bpf-lb-sock-hostns-only`, which is forced "true"
+ # for the same reason.
 bpf-lb-algorithm-annotation: "false"
 bpf-lb-mode-annotation: "false"
 bpf-distributed-lru: "false"
@@ -180,11 +184,15 @@
 auto-direct-node-routes: "false"
 direct-routing-skip-unreachable: "false"
 enable-host-firewall: "false"
+ # List of devices used to attach bpf_host.o (implements BPF NodePort,
+ # host-firewall and BPF masquerading)
+ devices: ""
 kube-proxy-replacement: "true"
 kube-proxy-replacement-healthz-bind-address: ""
 enable-no-service-endpoints-routable: "true"
 bpf-lb-sock: "false"
 enable-health-check-nodeport: "true"
+ enable-dynamic-source-lookup-nodeport: "false"
 enable-health-check-loadbalancer-ip: "false"
 node-port-bind-protection: "true"
 enable-auto-protect-node-port-range: "true"
@@ -269,18 +277,23 @@
 proxy-max-concurrent-retries: "128"
 proxy-use-original-source-address: "true"
 proxy-cluster-max-connections: "1024"
+ proxy-cluster-max-pending-requests: "1024"
 proxy-cluster-max-requests: "1024"
 http-retry-count: "3"
 http-stream-idle-timeout: "300"
+ envoy-node-locality-enabled: "false"
 external-envoy-proxy: "false"
 envoy-base-id: "0"
+ envoy-access-log-enabled: "true"
 envoy-access-log-buffer-size: "4096"
 envoy-keep-cap-netbindservice: "false"
+ envoy-xds-mode: "ads"
 max-connected-clusters: "255"
 clustermesh-cache-ttl: "0s"
 clustermesh-enable-endpoint-sync: "false"
 clustermesh-enable-mcs-api: "false"
 clustermesh-mcs-api-install-crds: "true"
+ clustermesh-default-global-namespace: "true"
 policy-default-local-cluster: "true"
 nat-map-stats-entries: "32"
 nat-map-stats-interval: "30s"
@@ -289,6 +302,8 @@
 enable-source-ip-verification: "true"
 enable-dynamic-config: "true"
 enable-drift-checker: "true"
+ enable-datapath-plugins: "false"
+ datapath-plugins-state-dir: "/var/run/cilium/plugins"
 # Extra config allows adding arbitrary properties to the cilium config.
 # By putting it at the end of the ConfigMap, it's also possible to override existing properties.
 ---
@@ -340,7 +355,6 @@
 - namespaces
 - services
 - pods
- - endpoints
 - nodes
 verbs:
 - get
@@ -371,7 +385,6 @@
 - cilium.io
 resources:
 - ciliumloadbalancerippools
- - ciliumbgppeeringpolicies
 - ciliumbgpnodeconfigs
 - ciliumbgpadvertisements
 - ciliumbgppeerconfigs
@@ -389,6 +402,7 @@
 - ciliumcidrgroups
 - ciliuml2announcementpolicies
 - ciliumpodippools
+ - ciliumdatapathplugins
 verbs:
 - list
 - watch
@@ -498,6 +512,7 @@
 # to check apiserver connectivity
 - namespaces
 - secrets
+ - serviceaccounts
 verbs:
 - get
 - list
@@ -507,22 +522,23 @@
 resources:
 # to perform the translation of a CNP that contains `ToGroup` to its endpoints
 - services
- - endpoints
 verbs:
 - get
 - list
 - watch
 - apiGroups:
+ # Watch CNP / CCNPs for validation and external groups.
 - cilium.io
 resources:
 - ciliumnetworkpolicies
 - ciliumclusterwidenetworkpolicies
 verbs:
- # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'
+ # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'.
+ # This was removed in v1.20, but we must keep the permissions until v1.21 for
+ # upgrade phasing.
 - create
 - update
 - deletecollection
- # To update the status of the CNPs and CCNPs
 - patch
 - get
 - list
@@ -533,7 +549,7 @@
 - ciliumnetworkpolicies/status
 - ciliumclusterwidenetworkpolicies/status
 verbs:
- # Update the auto-generated CNPs and CCNPs status.
+ # Set validity status on CNP / CCNP.
 - patch
 - update
 - apiGroups:
@@ -576,9 +592,12 @@
 resources:
 - ciliumendpointslices
 - ciliumenvoyconfigs
+ - ciliumbgpclusterconfigs
+ - ciliumbgpnodeconfigoverrides
 - ciliumbgppeerconfigs
 - ciliumbgpadvertisements
 - ciliumbgpnodeconfigs
+ - ciliumcidrgroups
 verbs:
 - create
 - update
@@ -631,15 +650,26 @@
 - ciliuml2announcementpolicies.cilium.io
 - ciliumpodippools.cilium.io
 - ciliumgatewayclassconfigs.cilium.io
+ - ciliumdatapathplugins.cilium.io
+ - apiGroups:
+ - apiextensions.k8s.io
+ resources:
+ - customresourcedefinitions/status
+ verbs:
+ - update
+ resourceNames:
+ - ciliumbgpclusterconfigs.cilium.io
+ - ciliumbgppeerconfigs.cilium.io
+ - ciliumbgpadvertisements.cilium.io
+ - ciliumbgpnodeconfigs.cilium.io
+ - ciliumbgpnodeconfigoverrides.cilium.io
 - apiGroups:
 - cilium.io
 resources:
 - ciliumloadbalancerippools
 - ciliumpodippools
- - ciliumbgppeeringpolicies
- - ciliumbgpclusterconfigs
- - ciliumbgpnodeconfigoverrides
 - ciliumbgppeerconfigs
+ - ciliumdatapathplugins
 verbs:
 - get
 - list
@@ -689,7 +719,6 @@
 - ""
 resources:
 - componentstatuses
- - endpoints
 - namespaces
 - nodes
 - pods
@@ -832,6 +861,14 @@
 - get
 - list
 - watch
+ - apiGroups:
+ - ""
+ resources:
+ - serviceaccounts
+ verbs:
+ - get
+ - list
+ - watch
 ---
 # Source: cilium/templates/hubble/tls-cronjob/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -1048,7 +1085,7 @@
 type: Unconfined
 containers:
 - name: cilium-agent
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 command:
 - cilium-agent
@@ -1221,7 +1258,7 @@
 mountPath: /tmp
 initContainers:
 - name: config
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 command:
 - cilium-dbg
@@ -1254,7 +1291,7 @@
 # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
 # We use nsenter command with host's cgroup and mount namespaces enabled.
 - name: mount-cgroup
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 env:
 - name: CGROUP_ROOT
@@ -1291,7 +1328,7 @@
 drop:
 - ALL
 - name: apply-sysctl-overwrites
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 env:
 - name: BIN_PATH
@@ -1329,7 +1366,7 @@
 # from a privileged container because the mount propagation bidirectional
 # only works from privileged containers.
 - name: mount-bpf-fs
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 args:
 - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
@@ -1345,7 +1382,7 @@
 mountPath: /sys/fs/bpf
 mountPropagation: Bidirectional
 - name: wait-for-node-init
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 command:
 - bash
@@ -1360,7 +1397,7 @@
 - name: cilium-bootstrap-file-dir
 mountPath: "/tmp/cilium-bootstrap.d"
 - name: clean-cilium-state
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 command:
 - /init-container.sh
@@ -1411,7 +1448,7 @@
 mountPath: /var/run/cilium # wait-for-kube-proxy
 # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent
 - name: install-cni-binaries
- image: "quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92"
+ image: "quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93"
 imagePullPolicy: IfNotPresent
 command:
 - "/install-plugin.sh"
@@ -1439,6 +1476,7 @@
 automountServiceAccountToken: true
 terminationGracePeriodSeconds: 1
 hostNetwork: true
+ hostUsers: true
 affinity:
 podAntiAffinity:
 requiredDuringSchedulingIgnoredDuringExecution:
@@ -1592,7 +1630,7 @@
 type: Unconfined
 containers:
 - name: node-init
- image: "quay.io/cilium/startup-script:1763560095-8f36c34@sha256:50b9cf9c280096b59b80d2fc8ee6638facef79ac18998a22f0cbc40d5d28c16f"
+ image: "quay.io/cilium/startup-script:1782916218-36ae25f@sha256:f99e2beda7324e93ba04d6240d9626a6b9ab023d7d56e3b029d3d9c823ce63ef"
 imagePullPolicy: IfNotPresent
 lifecycle:
 env:
@@ -1648,6 +1686,7 @@
 tolerations:
 - operator: Exists
 hostPID: true
+ hostUsers: true
 hostNetwork: true
 priorityClassName: system-node-critical
 automountServiceAccountToken: false
@@ -1696,7 +1735,7 @@
 type: RuntimeDefault
 containers:
 - name: cilium-operator
- image: "quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665"
+ image: "quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3"
 imagePullPolicy: IfNotPresent
 command:
 - cilium-operator-generic
@@ -1762,6 +1801,7 @@
 - ALL
 terminationMessagePolicy: FallbackToLogsOnError
 hostNetwork: true
+ hostUsers: true
 restartPolicy: Always
 priorityClassName: system-cluster-critical
 serviceAccountName: "cilium-operator"
@@ -1832,12 +1872,13 @@
 capabilities:
 drop:
 - ALL
+ readOnlyRootFilesystem: true
 runAsGroup: 65532
 runAsNonRoot: true
 runAsUser: 65532
 seccompProfile:
 type: RuntimeDefault
- image: "quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44"
+ image: "quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94"
 imagePullPolicy: IfNotPresent
 command:
 - hubble-relay
@@ -1879,6 +1920,8 @@
 # Retry more frequently at startup so that it can be considered started more quickly.
 periodSeconds: 3
 volumeMounts:
+ - name: tmp-volume
+ mountPath: /tmp
 - name: config
 mountPath: /etc/hubble-relay
 readOnly: true
@@ -1901,6 +1944,8 @@
 nodeSelector:
 kubernetes.io/os: linux
 volumes:
+ - name: tmp-volume
+ emptyDir: {}
 - name: config
 configMap:
 name: hubble-relay-config
@@ -1952,7 +1997,10 @@
 securityContext:
 fsGroup: 1001
 runAsGroup: 1001
+ runAsNonRoot: true
 runAsUser: 1001
+ seccompProfile:
+ type: RuntimeDefault
 priorityClassName:
 serviceAccountName: "hubble-ui"
 automountServiceAccountToken: true
@@ -1980,6 +2028,9 @@
 terminationMessagePolicy: FallbackToLogsOnError
 securityContext:
 allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
 - name: backend
 image: "quay.io/cilium/hubble-ui-backend:v0.13.5@sha256:fac0c300ae119274edca11fd89b1ad23c788792d8bc4ea2ba631c709e8d3c688"
 imagePullPolicy: IfNotPresent
@@ -1995,6 +2046,9 @@
 terminationMessagePolicy: FallbackToLogsOnError
 securityContext:
 allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
 nodeSelector:
 kubernetes.io/os: linux
 volumes:
@@ -2003,13 +2057,14 @@
 name: hubble-ui-nginx
 name: hubble-ui-nginx-conf
 - name: tmp-dir
- emptyDir: {}
+ emptyDir:
+ sizeLimit: 256Mi
 ---
 # Source: cilium/templates/hubble/tls-cronjob/job.yaml
 apiVersion: batch/v1
 kind: Job
 metadata:
- name: hubble-generate-certs-e142a12663
+ name: hubble-generate-certs-1ca5f01f86
 namespace: default
 labels:
 k8s-app: hubble-generate-certs
@@ -2026,7 +2081,7 @@
 type: RuntimeDefault
 containers:
 - name: certgen
- image: "quay.io/cilium/certgen:v0.4.6@sha256:511cedee817713fdf72db7e32fffb4b90da7747661b95180064f18198877626c"
+ image: "quay.io/cilium/certgen:v0.4.8@sha256:e65f1d15a0ffaf2df32797c8ad1c797fc64dad11c274cd96a2eafa89d712cdc3"
 imagePullPolicy: IfNotPresent
 securityContext:
 capabilities:
@@ -2044,6 +2099,7 @@
 - "--ca-secret-namespace=default"
 - "--ca-secret-name=cilium-ca"
 - "--ca-common-name=Cilium CA"
+ - "--ca-enforce-validity-throughout-leaves-duration=true"
 env:
 - name: CILIUM_CERTGEN_CONFIG
 value: |
@@ -2101,7 +2157,7 @@
 type: RuntimeDefault
 containers:
 - name: certgen
- image: "quay.io/cilium/certgen:v0.4.6@sha256:511cedee817713fdf72db7e32fffb4b90da7747661b95180064f18198877626c"
+ image: "quay.io/cilium/certgen:v0.4.8@sha256:e65f1d15a0ffaf2df32797c8ad1c797fc64dad11c274cd96a2eafa89d712cdc3"
 imagePullPolicy: IfNotPresent
 securityContext:
 capabilities:
@@ -2119,6 +2175,7 @@
 - "--ca-secret-namespace=default"
 - "--ca-secret-name=cilium-ca"
 - "--ca-common-name=Cilium CA"
+ - "--ca-enforce-validity-throughout-leaves-duration=true"
 env:
 - name: CILIUM_CERTGEN_CONFIG
 value: |