chore(deps): update helm release cilium to v1.19.5

[renovate]

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	1.19.4 → 1.19.5

---

Release Notes

cilium/cilium (cilium)

v1.19.5: 1.19.5

Compare Source

Summary of Changes

Minor Changes:

• Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #​46554, Upstream PR #​46516, @​giorio94)
• helm: Remove loadBalancer.standalone option (Backport PR #​46170, Upstream PR #​46070, @​joestringer)
• wireguard:mtu: fix mtu calculation with potential padding (Backport PR #​46170, Upstream PR #​45940, @​smagnani96)

Bugfixes:

• Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #​46170, Upstream PR #​46068, @​MrFreezeex)
• azure: Fix public IP reassignment failure loop on operator restart (Backport PR #​46289, Upstream PR #​46240, @​HadrienPatte)
• bgp: Don't provide default_gateway reconciler when disabled (Backport PR #​46024, Upstream PR #​45911, @​YutaroHayakawa)
• bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #​46245, Upstream PR #​45927, @​rastislavs)
• bpf: fix host proxy packet routing to pods (Backport PR #​46024, Upstream PR #​45916, @​atykhyy)
• bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #​46170, Upstream PR #​45937, @​nickolaev)
• datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #​46028, Upstream PR #​45799, @​bersoare)
• Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #​46024, Upstream PR #​45926, @​julianwiedmann)
• Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #​46170, Upstream PR #​45780, @​adamwathieu)
• Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #​46170, Upstream PR #​45967, @​ysksuzuki)
• Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #​46024, Upstream PR #​45572, @​ajmmm)
• Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #​45966, Upstream PR #​45371, @​syedazeez337)
• Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR #​46456, Upstream PR #​46305, @​TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #​46400, Upstream PR #​46340, @​arybolovlev)
• fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #​46400, Upstream PR #​46237, @​ulrichgiraud)
• fix: nil pointer dereference panic due to uninitialized logger (Backport PR #​46170, Upstream PR #​45782, @​weizhoublue)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #​46554, Upstream PR #​46091, @​eyupcanakman)
• Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #​46170, Upstream PR #​46079, @​giorio94)
• Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #​46024, Upstream PR #​45791, @​squeed)
• gateway-api/ingress: set service label on EndpointSlices (Backport PR #​46400, Upstream PR #​46242, @​mhofstetter)
• gateway-api: fix GatewayClass field index (Backport PR #​46289, Upstream PR #​46127, @​thorn3r)
• gateway-api: prune stale Gateway API route parent statuses (Backport PR #​46400, Upstream PR #​46296, @​mhofstetter)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #​46554, Upstream PR #​46412, @​giorio94)
• iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #​46289, Upstream PR #​45974, @​bersoare)
• multipool: Fix retries for CiliumNode Get errors (Backport PR #​46408, Upstream PR #​46124, @​pippolo84)
• sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR #​46024, Upstream PR #​44843, @​umut-polat)
• The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#​46462, @​joamaki)

CI Changes:

• chore(deps): update lvh-images for conformance-runtime (Backport PR #​46025, Upstream PR #​45922, @​julianwiedmann)
• ci:bpftrace: fail curl with corrupted binary download (Backport PR #​46024, Upstream PR #​45948, @​smagnani96)
• fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR #​46289, Upstream PR #​44545, @​liyihuang)
• gha: make conformance kubespray runner configurable (Backport PR #​46289, Upstream PR #​46171, @​giorio94)
• helm: add tmpl files to .helmignore (Backport PR #​46554, Upstream PR #​46445, @​sekhar-isovalent)
• helm: allow overriding of registry_prefix in charts (Backport PR #​46289, Upstream PR #​46217, @​sekhar-isovalent)
• ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR #​46289, Upstream PR #​46188, @​pippolo84)
• Move pull_request triggered workflows to ariane (Backport PR #​46452, Upstream PR #​45363, @​nebril)
• Reapply "ci: Log in for image registry pulls" (Backport PR #​46495, Upstream PR #​46376, @​nebril)

Misc Changes:

• [v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (#​46578, @​aanm)
• [v1.19] Backport health command fixes from 46102 (#​46250, @​joamaki)
• [v1.19] deps: bump various go packages (#​46185, @​ferozsalam)
• [v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (#​46425, @​tklauser)
• bpf: local_delivery: add CB flag for "use_redirect_peer" (Backport PR #​46204, Upstream PR #​46169, @​julianwiedmann)
• bpf: local_delivery: condense usage of skb cb slots (Backport PR #​46204, Upstream PR #​46064, @​julianwiedmann)
• bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (Backport PR #​46554, Upstream PR #​46291, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.19) (#​45994, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46016, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46117, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46268, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46280, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46395, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46538, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​45468, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​46581, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​45995, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​46164, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.11 (v1.19) (#​46342, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.19) (#​46153, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 11ecd4e (v1.19) (#​46277, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to cd47774 (v1.19) (#​46137, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to e1b3ec8 (v1.19) (#​46007, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) (#​46120, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) (#​46267, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) (#​46150, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) (#​46266, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) (#​46570, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.19) (#​46535, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.19) (#​46138, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.19) (#​46536, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (#​46560, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (#​46139, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (#​46561, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (#​46377, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​45392, @​cilium-renovate[bot])
• docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR #​46289, Upstream PR #​45843, @​atykhyy)
• docs: Document BTF as a requirement (Backport PR #​46289, Upstream PR #​46063, @​pchaigno)
• docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR #​46024, Upstream PR #​45751, @​bitflicker64)
• Fix broken gateway-api documentation links (Backport PR #​46554, Upstream PR #​46527, @​0xch4z)
• Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR #​46400, Upstream PR #​46355, @​weizhoublue)
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (#​46140, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) (#​46015, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) (#​46562, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to ff6756f (v1.19) (#​45996, @​cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (#​45997, @​cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (#​46537, @​cilium-renovate[bot])
• Miscellaneous improvements to the fake client (Backport PR #​46024, Upstream PR #​45784, @​giorio94)
• operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR #​46554, Upstream PR #​46502, @​giorio94)
• Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR #​46170, Upstream PR #​46093, @​salamidrus)
• Revert ".github/workflows: do not use deployments for environments" (Backport PR #​46400, Upstream PR #​46348, @​aanm)

Other Changes:

• [v1.19] proxy: Bump upstream version to v1.37.x (#​46439, @​sayboras)
• install: Update image digests for v1.19.4 (#​45961, @​cilium-release-bot[bot])
• v1.19: kvstore: Don't set fake pod CIDRs for remote nodes (#​46361, @​pchaigno)
• vendor: bump statedb to v0.5.8 (#​46505, @​giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.5@​sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.5@​sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b

docker-plugin

quay.io/cilium/docker-plugin:v1.19.5@​sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea

hubble-relay

quay.io/cilium/hubble-relay:v1.19.5@​sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.5@​sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16

operator-aws

quay.io/cilium/operator-aws:v1.19.5@​sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707

operator-azure

quay.io/cilium/operator-azure:v1.19.5@​sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8

operator-generic

quay.io/cilium/operator-generic:v1.19.5@​sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4

operator

quay.io/cilium/operator:v1.19.5@​sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Helm Template Diff

00_cilium

22 changed lines

--- /tmp/old.yaml	2026-06-22 18:22:00.534417104 +0000
+++ /tmp/new.yaml	2026-06-22 18:22:00.004405554 +0000
@@ -1097,7 +1097,7 @@
           type: Unconfined
       containers:
       - name: cilium-agent
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         command:
         - cilium-agent
@@ -1275,7 +1275,7 @@
         
       initContainers:
       - name: config
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         command:
         - cilium-dbg
@@ -1308,7 +1308,7 @@
       # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
       # We use nsenter command with host's cgroup and mount namespaces enabled.
       - name: mount-cgroup
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         env:
         - name: CGROUP_ROOT
@@ -1345,7 +1345,7 @@
             drop:
               - ALL
       - name: apply-sysctl-overwrites
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         env:
         - name: BIN_PATH
@@ -1383,7 +1383,7 @@
       # from a privileged container because the mount propagation bidirectional
       # only works from privileged containers.
       - name: mount-bpf-fs
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         args:
         - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
@@ -1399,7 +1399,7 @@
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         command:
         - /init-container.sh
@@ -1450,7 +1450,7 @@
           mountPath: /var/run/cilium # wait-for-kube-proxy
       # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent
       - name: install-cni-binaries
-        image: "quay.io/cilium/cilium:v1.19.4@sha256:2eb67991eaa9368ba199c2fac2c573cb0ffdeb79184533344f42fc9a7ff6af3c"
+        image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"
         imagePullPolicy: IfNotPresent
         command:
           - "/install-plugin.sh"
@@ -1641,7 +1641,7 @@
       
       containers:
       - name: cilium-envoy
-        image: "quay.io/cilium/cilium-envoy:v1.36.6-1778235340-b87d1e32f522b33bd51701c6476d199326f01496@sha256:71d4fa0ec45e8d546dbd5604e169dc77fe92be63b799313bff031d00d89762e3"
+        image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed"
         imagePullPolicy: IfNotPresent
         command:
         - /usr/bin/cilium-envoy-starter
@@ -1829,7 +1829,7 @@
           type: RuntimeDefault
       containers:
       - name: cilium-operator
-        image: "quay.io/cilium/operator-generic:v1.19.4@sha256:1aa2b62735e7d8ab49ee840ae59c346932024c88901579121395c1271b435f71"
+        image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4"
         imagePullPolicy: IfNotPresent
         command:
         - cilium-operator-generic
@@ -1975,7 +1975,7 @@
             runAsUser: 65532
             seccompProfile:
               type: RuntimeDefault
-          image: "quay.io/cilium/hubble-relay:v1.19.4@sha256:59af8c0d561e560c2a042e7600a3496bc0367df8fbf868aa68d5834c8ec1a431"
+          image: "quay.io/cilium/hubble-relay:v1.19.5@sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c"
           imagePullPolicy: IfNotPresent
           command:
             - hubble-relay