cilium/cilium v1.19.0-pre.1 Release Notes

Published at: 2025-10-01T23:32:07Z

Summary of Changes

Major Changes:

cilium: add IP option packet tracing feature (cilium/cilium#41306, @Bigdelle)
policy: add option to return ICMP “Destination unreachable” on ipv4 egress policy denials (cilium/cilium#41406, @antonipp)

Minor Changes:

Allow bypassing conntrack in pods with hostNetwork: true (cilium/cilium#41364, @bersoare)
bgp: optionally withdraw route when service has 0 endpoints to allow balancing to a different DC/cluster (anycast) (cilium/cilium#40717, @oblazek)
bpf: Apply monitor-aggregation semantics to socket translation events and align socket trace cadence with monitor-aggregation-interval. (cilium/cilium#40807, @pillai-ashwin)
Change the default AddressScopeMax to 254(host scope) so it works with new GKE meta data server and HCP use cases. If you need to roll back to the previous behavior, you can set –local-max-addr-scope=252 for Cilium agent (cilium/cilium#41778, @liyihuang)
clustemesh: update MCS-API support with latest status condition change on ServiceImport and ServiceExport (cilium/cilium#41417, @MrFreezeex)
clustermesh: add endpoints metrics and change global service (and MCS ServiceExport) metrics to report per cluster metrics instead of a global count (cilium/cilium#41323, @MrFreezeex)
clustermesh: add ServiceImport clusters count metric (cilium/cilium#41863, @MrFreezeex)
clustermesh: Kubernetes 1.35 will include by default the CoreDNS version we need for MCS-API (cilium/cilium#41418, @MrFreezeex)
clustermesh: propagate zone information in ClusterMesh GlobalService to alllow topology aware/traffic distribution relying on zones (cilium/cilium#41390, @MrFreezeex)
cni: reduce timeout on deletion to 1.5s (cilium/cilium#41586, @sugangli)
feat(sdp): Enhanced SDP/FQDN integration with error enums, send and recv policy data to client, and a new IsEnabled() flag for standalone DNS proxy control. (cilium/cilium#40689, @vipul-21)
helm: Cleanup KPR values for old cilium versions (cilium/cilium#41537, @sayboras)
hubble: add emitter information to Hubble flow (cilium/cilium#41879, @rolinh)
hubble: mark kafka l7 visibility as deprecated (cilium/cilium#41072, @kaworu)
IPv6 support for pods connecting to themselves via a k8s service (“service loopback”). (cilium/cilium#39594, @saiaunghlyanhtet)
k8s: Update tests and libraries to v1.34.0 (cilium/cilium#41176, @sayboras)
multipool: add support for matching pods to PodIPPools via label selectors (cilium/cilium#41688, @alimehrabikoshki)
nodeipam: improve logging on error cases to easily debug NodeIPAM failing and/or not including any IPs (cilium/cilium#41582, @MrFreezeex)
operator: manually register certwatcher metrics. (cilium/cilium#41041, @tommyp1ckles)
Rate-limit lost events sent from the Hubble Observer (cilium/cilium#41163, @devodev)
The special IPsec mode to enable encrypted overlay in combination with the Multicast feature (–enable-ipsec-encrypted-overlay) has been deprecated, and will be removed in a future release. Starting from Cilium 1.18 the IPsec encryption is always applied after overlay encapsulation, and therefore this special opt-in flag is no longer needed. (cilium/cilium#41740, @julianwiedmann)

Bugfixes:

add the port name for address based LRP so frontend can pick the right backend (cilium/cilium#41602, @liyihuang)
analyze: fix race accessing Block.predict (cilium/cilium#41625, @ti-mo)
Avoid scenario where ENI device configuration can be skipped. (cilium/cilium#41760, @jasonaliyetti)
Cilium now configures Envoy to allow websocket connections to be passed through with HTTP policies. (cilium/cilium#41729, @jrajahalme)
clustermesh: make sure ExternalName service are not exported in MCS-API (cilium/cilium#41850, @MrFreezeex)
ctmap/gc: continue interval time on partial GC pass. (cilium/cilium#41258, @tommyp1ckles)
Fix “Error while correcting L4 checksum” dropped packets for ICMP destination unreachable error packets. (cilium/cilium#40194, @br4243)
Fix a bug that was preventing Cilium to delete stale pod CIDRs routes when changing routing mode to native (cilium/cilium#41819, @pippolo84)
Fix a bug that would cause NodePort requests to be sent to the wrong backends when using KPR and Clustermesh with two identical, non-global NodePort services on different clusters. (cilium/cilium#41337, @pchaigno)
Fix BGP auto discovery not sending community info (cilium/cilium#41920, @jiashengz)
Fix bug in ENI routing where Cilium would chose the wrong subnet for routing traffic on secondary interfaces (cilium/cilium#40860, @liyihuang)
Fix bug that could cause ICMP error packets to have an incorrect inner IP checksum when KPR is enabled. (cilium/cilium#41551, @yushoyamaguchi)
Fix bug with delegated IPAM where IPv6 traffic was routed via the wrong interface (cilium/cilium#41598, @NihaNallappagari)
Fix issue in Local Redirect Policies where traffic was dropped when no local pods were available to be redirected to. In these scenarios the traffic should have been processed as if the Local Redirect Policy did not exist. (cilium/cilium#41463, @joamaki)
Fix issue where Local Redirect Policy (LRP) services with a single named port did not create a local redirect service entry. (cilium/cilium#41534, @aditighag)
Fix race condition preventing the skiplbmap BPF map from sometimes being pruned after restart. (cilium/cilium#41529, @joamaki)
Fix verifier error that occurs when enabling l2 annoucements on a l2-less device (cilium/cilium#41595, @dylandreimerink)
hostfw: also exclude non-transparent proxy traffic when BPF masq is enabled (cilium/cilium#41915, @julianwiedmann)
Ignore expected error in neighbor reconciliation (cilium/cilium#41815, @dylandreimerink)
IPAM (MultiPool): Honor ipam-cilium-node-update-rate for CiliumNode updates (was hardcoded to 15s by default). Default remains 15s. (cilium/cilium#41447, @asdfmi)
loadbalancer: allow HostPort for multiple protos on same port (cilium/cilium#41521, @bersoare)
operator/pkg/lbipam: fix LoadBalancerIPPool conditions update logic (cilium/cilium#41322, @alimehrabikoshki)
Register cluster-pool IPAM metrics related to CiliumNode synchronization with k8s (cilium/cilium#41531, @pippolo84)
The first Envoy listener xDS (LDS) response is sent only after the first ACK on Clusters has been received if there are any dynamically configured clusters. (cilium/cilium#41552, @jrajahalme)

CI Changes:

.actions/cilium-config: add missing extraEnv in GH action (cilium/cilium#41420, @aanm)
.github/conformance: fix concurrency group for ipsec (cilium/cilium#41825, @aanm)
.github/worfklows: copy cilium-cli binary from container (cilium/cilium#41524, @aanm)
.github/workflows: add variable for renovate bot username (cilium/cilium#41818, @aanm)
.github/workflows: automatically add /test for renovate PRs (cilium/cilium#41770, @aanm)
.github/workflows: do not wait on linters form forks (cilium/cilium#41822, @aanm)
.github/workflows: remove reviewers requested by auto-committer[bot] (cilium/cilium#41759, @aanm)
actions/eks: remove leftover ipsec:true entry (cilium/cilium#41909, @aanm)
Add vanilla cloud-provider configs for conformance tests (cilium/cilium#40623, @aanm)
bpf: complexity-tests: minor improvements (cilium/cilium#41546, @julianwiedmann)
bpf: remove testing with ENABLE_IPSEC for bpf_lxc (cilium/cilium#41527, @julianwiedmann)
bpf: test: improve network policy testing (cilium/cilium#41906, @julianwiedmann)
bpf: test: remove KERNEL=54 support (cilium/cilium#41460, @julianwiedmann)
bpf: tests: add helpers to call entrypoints (cilium/cilium#41878, @julianwiedmann)
bpf: tests: misc cleanups (cilium/cilium#41465, @julianwiedmann)
check-encryption-leak: don’t skip plain-text TCP RST packets (cilium/cilium#41765, @julianwiedmann)
ci: add conformance-race (cilium/cilium#41541, @aanm)
ci: enable copyloopvar linter (cilium/cilium#41893, @tklauser)
ci: Gateway API conformance tests now attribute failures to code owners and upload JUnit results for CI dashboards. (cilium/cilium#41164, @pillai-ashwin)
cilium-cli, netns: fix golangci-lint 2.5.0 errors (cilium/cilium#41856, @tklauser)
cilium-cli: Bring back NodePort Acceleration feature detection (cilium/cilium#41812, @brb)
datapath/neighbor: Reduce flakiness in Kernel ARP test (cilium/cilium#41775, @dylandreimerink)
Fix policy debug logging fd leak (cilium/cilium#41366, @bimmlerd)
Fix renovate config (cilium/cilium#41584, @aanm)
Fix some dependencies updates with renovate config (cilium/cilium#41575, @aanm)
gh: e2e-upgrade: split off non-standard configs (cilium/cilium#41937, @julianwiedmann)
gh: e2e-upgrade: temporarily disable XDP for config 6 and 14 (cilium/cilium#41772, @julianwiedmann)
gha/conformance-clustermesh: let service nodeport be selected randomly (cilium/cilium#41697, @giorio94)
gha: Correct k8s version for f12-datapath-service-ns-misc (cilium/cilium#41753, @sayboras)
gha: Reduce stress testing scope for EGW scale workflow (cilium/cilium#41972, @aditighag)
github: fix concurrency group naming in conformance workflows (cilium/cilium#41951, @aanm)
operator/bgpv2: Avoid race in TestRouterIDAllocation test (cilium/cilium#41499, @rastislavs)
pkg/loadbalancer/tests: Fix expected output in graceful-termination (cilium/cilium#41728, @joamaki)
renovate: add more trusted dependencies for auto merging (cilium/cilium#41518, @aanm)
test: Extend L7LB test for ipv6 (cilium/cilium#41542, @sayboras)
workflows/eks: Fix cluster name for scheduled runs (cilium/cilium#41956, @pchaigno)
workflows: Extend EKS + KPR tests (cilium/cilium#41877, @pchaigno)

Misc Changes:

.github/renovate: add postUpgradeTasks for cilium/charts (cilium/cilium#41914, @aanm)
.github/workflows: stop build CI images until base images are built (cilium/cilium#41681, @aanm)
Add documentation about dynamic Hubble Metrics [CFP-30788]. (cilium/cilium#41736, @tnorlin)
agent: Add Cilium health config cell (cilium/cilium#41627, @aditighag)
Avoid loading / verifying tail calls for features which have been disabled using load time configuration (cilium/cilium#41421, @dylandreimerink)
aws operator pulls its own VPC resources based on its own vpc id (cilium/cilium#41783, @liyihuang)
bgpv1: Fix typo in comment (cilium/cilium#41749, @hargrovee)
bgpv2: Fix incorrect method names and versions in comments (cilium/cilium#41870, @hargrovee)
bgpv2: Migrate service reconciler to use loadbalancer tables in StateDB (cilium/cilium#40916, @rastislavs)
bpf/analyze: refactor reachability analysis and unused tail call elim (cilium/cilium#41875, @ti-mo)
bpf/nat: Move ipv6_nat_entry to map (cilium/cilium#41902, @pchaigno)
bpf/tests: allow running a single unit test (for real). BPF_TEST (cilium/cilium#41132, @msune)
bpf: Add tcx_early_hook infra (cilium/cilium#41821, @borkmann)
bpf: clean up include statements for csum.h (cilium/cilium#41454, @julianwiedmann)
bpf: declare IP header pointer variables as __maybe_unused (cilium/cilium#41704, @tklauser)
bpf: encrypt: align Wireguard and ESP in to-netdev program (cilium/cilium#41455, @julianwiedmann)
bpf: encrypt: remove SPI-related parameters from set_ipsec_encrypt() (cilium/cilium#41525, @julianwiedmann)
bpf: Fix handling of encrypted packets in bpf_host (cilium/cilium#41852, @pchaigno)
bpf: host: remove stale do_netdev_encrypt_encap() path (cilium/cilium#41452, @julianwiedmann)
bpf: improve L3 device handling (cilium/cilium#41750, @julianwiedmann)
bpf: lxc: remove unused IPsec code in encap handling (cilium/cilium#41464, @julianwiedmann)
bpf: Migrate WG_IFINDEX and WG_PORT to runtime config (cilium/cilium#41137, @jrife)
bpf: Only send fillup signal to agent on ENOMEM error (cilium/cilium#41864, @borkmann)
bpf: unify CFLAGS deduction into a common Makefile.clang (cilium/cilium#39831, @msune)
bpf: use helper function to handle nonroutable endpoints (cilium/cilium#41751, @oblazek)
bpf: use redirect_neigh() for punting reply traffic to parent interface (cilium/cilium#41453, @julianwiedmann)
bpf: wireguard: minor cleanups (cilium/cilium#41692, @julianwiedmann)
build-images-release: specify main branch on reusable jobs (cilium/cilium#41530, @aanm)
build: Include hubble CLI directory in cilium container directories (cilium/cilium#41159, @HadrienPatte)
chore(deps): update all github action dependencies (main) (cilium/cilium#41564, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (cilium/cilium#41655, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (cilium/cilium#41791, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (cilium/cilium#41929, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (patch) (cilium/cilium#41786, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#41559, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#41787, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#41925, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (cilium/cilium#41486, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (cilium/cilium#41611, @cilium-renovate[bot])
chore(deps): update cilium/cilium-cli action to v0.18.7 (main) (cilium/cilium#41512, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v32.1 (main) (cilium/cilium#41652, @cilium-renovate[bot])
chore(deps): update docker.io/alpine/socat:1.8.0.3 docker digest to 0ce60b5 (main) (cilium/cilium#41558, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.1 docker digest to 8305f5f (main) (cilium/cilium#41649, @cilium-renovate[bot])
chore(deps): update go to v1.25.1 (main) (cilium/cilium#41560, @cilium-renovate[bot])
chore(deps): update golangci/golangci-lint docker tag to v2.5.0 (main) (cilium/cilium#41805, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.2-1757248876-6e6f5d6763a6b437fc83c44943492d96d9c5c9aa (main) (cilium/cilium#41572, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.116.6 (main) (cilium/cilium#41653, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.121.4 (main) (cilium/cilium#41788, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.122.0 (main) (cilium/cilium#41800, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.122.1 (main) (cilium/cilium#41802, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.122.2 (main) (cilium/cilium#41803, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.122.3 (main) (cilium/cilium#41804, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.131.8 (main) (cilium/cilium#41928, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.131.9 (main) (cilium/cilium#41932, @cilium-renovate[bot])
chore(deps): update renovate dependencies to v41.97.7 (main) (cilium/cilium#41562, @cilium-renovate[bot])
ci: bump libtinfo to v6 for ci-integration (cilium/cilium#41769, @Artyop)
cli/clustermesh: remove leftover global services status info (cilium/cilium#41727, @giorio94)
clustermesh: add back GlobalServiceCache usage in the agent (cilium/cilium#41685, @MrFreezeex)
clustermesh: minor cleanups for clustermesh metrics (cilium/cilium#41924, @MrFreezeex)
clustermesh: unconditionally invoke [NodeManager.MeshNodeSync] (cilium/cilium#41957, @giorio94)
CODEOWNERS: assign Hubble metrics documentation to @cilium/hubble-metrics (cilium/cilium#41738, @tklauser)
daemon: implement daemon config validation with hive job (cilium/cilium#41907, @mhofstetter)
daemon: remove unused close method (cilium/cilium#41908, @mhofstetter)
daemon: use daemonParams as field (cilium/cilium#41891, @mhofstetter)
datapath: remove IPsec logic in bpf_overlay (cilium/cilium#41540, @julianwiedmann)
datapath: s/MARK_MAGIC_PROXY_TO_WORLD/MARK_MAGIC_SKIP_TPROXY (cilium/cilium#41813, @julianwiedmann)
datapath: strictly require even more BPF functionality (remaining changes) (cilium/cilium#41489, @julianwiedmann)
doc: add note on hostfw and ipsec interaction (cilium/cilium#41810, @darox)
docs/dsr: Remove IPIP example configuration (cilium/cilium#41701, @pchaigno)
docs: Add FPT Telecom to USERS.md (cilium/cilium#41673, @minhng99)
docs: add table DSR Dispatch Mode following Routing Mode (cilium/cilium#41431, @alagoutte)
docs: Clarify list of capabilities in threat model (cilium/cilium#41682, @joestringer)
docs: fix broken Chainguard SBOM link (cilium/cilium#41719, @yashisrani)
docs: update coredns metric name (cilium/cilium#41590, @mikejoh)
docs: Update iproute2 compile steps in reference guide. (cilium/cilium#41638, @dkanaliev)
docs: Updated Rancher-managed RKE2 installation guide (cilium/cilium#41076, @fwardzic)
Document request-timeout ingress annotation (cilium/cilium#41603, @iofq)
documentation: add caveats about host L7 DNS policy (cilium/cilium#41423, @atykhyy)
endpointsynchronizer: suppress warning log when endpoint is terminating (cilium/cilium#41755, @giorio94)
Fix API throttling on the AWS DescribeSecurityGroups API when using the unpaginated API by passing maxResults (1000). (cilium/cilium#41684, @dwj300)
Fix checksum calculation on ICMPv6 NA when NS don’t have llsrc option. (cilium/cilium#41578, @msune)
Fix kind-install-cilium-fast Make target (cilium/cilium#41488, @youngnick)
Fix release script steps (cilium/cilium#41502, @aanm)
Fix typo in host firewall bypass module name (cilium/cilium#41675, @ovidiutirla)
fix(deps): update all go dependencies main (main) (cilium/cilium#41344, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (cilium/cilium#41563, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (cilium/cilium#41785, @cilium-renovate[bot])
fix(deps): update aws-sdk-go-v2 monorepo (main) (cilium/cilium#41561, @cilium-renovate[bot])
fix(deps): update aws-sdk-go-v2 monorepo (main) (cilium/cilium#41654, @cilium-renovate[bot])
fix(deps): update aws-sdk-go-v2 monorepo (main) (cilium/cilium#41926, @cilium-renovate[bot])
fix(deps): update go-openapi packages (main) (cilium/cilium#41927, @cilium-renovate[bot])
fix(deps): update kubernetes packages to v0.34.1 (main) (cilium/cilium#41650, @cilium-renovate[bot])
fix(deps): update module github.com/aws/aws-sdk-go-v2/service/ec2 to v1.253.0 (main) (cilium/cilium#41789, @cilium-renovate[bot])
fix(deps): update module github.com/azure/azure-sdk-for-go/sdk/azcore to v1.19.1 (main) (cilium/cilium#41651, @cilium-renovate[bot])
fix(deps): update module github.com/azure/azure-sdk-for-go/sdk/azidentity to v1.12.0 (main) (cilium/cilium#41790, @cilium-renovate[bot])
fix(deps): update module github.com/go-openapi/swag to v0.24.1 (main) (cilium/cilium#41434, @cilium-renovate[bot])
fqdn: Refactor and tighten matchpattern sanitization (cilium/cilium#41425, @joestringer)
gateway-api: Fix incorrect Owns call in refactor (cilium/cilium#41807, @youngnick)
gneigh: add InterfaceFromNetInterface (cilium/cilium#41880, @tklauser)
hubble: allow overrrides if building from outside the tree (cilium/cilium#41726, @tklauser)
hubble: Refactor drop event emitter as hive cell (cilium/cilium#41196, @devodev)
hubble: refactor the Namespace Manager as a Cell (cilium/cilium#41679, @kaworu)
images: Update bpftools and llvm images to reduce the size of the cilium image by 39MB (amd64) / 35MB (arm64) (cilium/cilium#41339, @HadrienPatte)
ipsec: add support for using remote PodCIDR entries (cilium/cilium#41519, @julianwiedmann)
ipsec: don’t reduce post-encrypt MTU for tunnel overhead (cilium/cilium#41573, @julianwiedmann)
ipsec: remove forwarding of encrypted traffic via cilium_host (cilium/cilium#41699, @julianwiedmann)
k8s/client/testutils: Fill in TypeMeta for objects added via clientset (cilium/cilium#41724, @joamaki)
k8s/client/testutils: Fix k8s/{summary,get} for objs added vie Clientset (cilium/cilium#41526, @joamaki)
kvstoremesh: fix regression in determining end of bootstrap phase (cilium/cilium#41771, @giorio94)
lb/config: add missing comment about support geneve for DSRDispatch (cilium/cilium#41408, @alagoutte)
loadbalancer: Use Table[LocalNode] instead of LocalNodeStore (cilium/cilium#40998, @joamaki)
mac: add MustParseMAC test helper and remove unused functions (cilium/cilium#41882, @tklauser)
Make kubeProxyReplacement available in the reference and documentation (cilium/cilium#41535, @liyihuang)
maps: clean up stale references to maps.h (cilium/cilium#41539, @julianwiedmann)
metrics/features: remove aws-vpc-cni (cilium/cilium#41498, @aanm)
misc: Refactored Hubble peer service to use a Hive cell. (cilium/cilium#41674, @Liang-gong-ci-fang)
Modify the unit test to cover the case that the backend container has more than one ports. (cilium/cilium#41642, @liyihuang)
Modularization of IPsec Agent. (cilium/cilium#41252, @smagnani96)
node/manager: Do not prune the local node on restart (cilium/cilium#41544, @joamaki)
node/manager: TestNodesStartupPruning poll state (cilium/cilium#41648, @0xch4z)
node: Set Cluster, Skip equal nodes (cilium/cilium#41294, @joamaki)
operator: rework and extract legacy cilium node synchronization logic. (cilium/cilium#41712, @giorio94)
pkg/container/set: Fixes string method with single element (cilium/cilium#41496, @41ks)
pkg/k8s: refactor to use reflect.TypeFor (cilium/cilium#41226, @cuiweixie)
policy: clean up unused code (cilium/cilium#41703, @tklauser)
Prepare for release v1.19.0-pre.0 (cilium/cilium#41494, @cilium-release-bot[bot])
proxy: implement proxy port restore/save with hive jobs (cilium/cilium#41910, @mhofstetter)
README: add v1.19.0-pre.0 release (cilium/cilium#41501, @aanm)
README: Update releases (cilium/cilium#41849, @jrajahalme)
redirectpolicy: Always OpenOrCreate SkipLB map to avoid loader race (cilium/cilium#41707, @joamaki)
redirectpolicy: Fix comparison of BackendParams (cilium/cilium#41705, @joamaki)
redirectpolicy: Forget watch set on deletion (cilium/cilium#41702, @joamaki)
Remove kiam documentation from Local Redirect Policy (cilium/cilium#41644, @liyihuang)
Remove unused EncryptedOverlayReqID constant (cilium/cilium#41831, @ldelossa)
Revert “bpf: unify CFLAGS handling in Makefile.clang” (cilium/cilium#41808, @msune)
Revert “helm: add clustermesh nodeport config warning about #24692” (cilium/cilium#41587, @pchaigno)
shell:hive: make shellSockPath configurable via cell config (cilium/cilium#41632, @smagnani96)
test/operator: fix TestUpdateUsedCIDIsReverted flakiness (cilium/cilium#41739, @giorio94)
Update checkpatch and startup-script image digest (cilium/cilium#41710, @HadrienPatte)
VTEP: introduce cells for VTEP map & VTEP manager (new) (cilium/cilium#41905, @mhofstetter)
wireguard: improve detection of from-proxy traffic (cilium/cilium#41851, @julianwiedmann)
workflows/conformance-ginkgo: fix steps for stable branches (cilium/cilium#41599, @aanm)
workflows/release: add secrets for step 4 and 5 (cilium/cilium#41721, @aanm)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.0-pre.1@sha256:202e41af73c0b8b772d1847c67b4d3f7d13f075fae16fa4ad9f6edd553d4f6f4

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.0-pre.1@sha256:6b71e886e99638ea0bd4c2857c004c99541c4673924b83cbe5d32869b576b7dd

docker-plugin

quay.io/cilium/docker-plugin:v1.19.0-pre.1@sha256:3e6549e3affa11de48cd6d1daeb0153ac1f8854f400bee6b9f9c36185a038df5

hubble-relay

quay.io/cilium/hubble-relay:v1.19.0-pre.1@sha256:47a3355286486d7a0021d91142e1d2c84a8ed9ceb375a22a5d3d15cce1e09f2e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.0-pre.1@sha256:28f9186ebd545928e210acd68269d5400c71429c055cca593613acfe818406f9

operator-aws

quay.io/cilium/operator-aws:v1.19.0-pre.1@sha256:31b3950971f54f1f395fc8d3adbf41b17dc208bc95a10431cc68ec54da57c80b

operator-azure

quay.io/cilium/operator-azure:v1.19.0-pre.1@sha256:99558fe9be99f0e0c8a3ca0c8bde45ab34718a8ba7b48438cc1a83cacd045234

operator-generic

quay.io/cilium/operator-generic:v1.19.0-pre.1@sha256:d92409eb3f603ab1f73c3e98eaf71eee6aada27b1bec5c1fd83be9358c0db263

operator

quay.io/cilium/operator:v1.19.0-pre.1@sha256:56c187d7abce39fb5fbb741c4e59ef71bbdef4abcc92dbe4dbaf0027c657df7e

Cilium V1.19.0 Pre.0 Release Note Cilium V1.19.0 Pre.2 Release Note