chore(deps): update dependency cilium/cilium to v1.18.8

[renovate]

This PR contains the following updates:

Package	Update	Change
cilium/cilium	patch	1.18.7 → 1.18.8

---

Release Notes

cilium/cilium (cilium/cilium)

v1.18.8: 1.18.8

Compare Source

Known issues

• Users who deploy Cilium on GKE should skip this version or upgrade to 1.19.2 due to a known regression.

Summary of Changes

Minor Changes:

• Allow to attach Cilium's XDP program on network interfaces that have jumbo MTU configured and support xdp.frags program type. (Backport PR #​44499, Upstream PR #​41967, @​viktor-kurchenko)

Bugfixes:

• bpf: nodeport: use hairpin redirect for L7 LB on bridge devices (Backport PR #​44758, Upstream PR #​44658, @​smagnani96)
• cilium-dbg: fix seg-fault ip get -l reserved:host (Backport PR #​44519, Upstream PR #​44443, @​aanm)
• Enable Cilium upgrade and downgrade when existing XDP attach types differ from new XDP programs (Backport PR #​44499, Upstream PR #​44209, @​dylandreimerink)
• Fix a bug where node IPv6 updates and deletes were not correctly propagated to the Linux kernel neighbor subsystem. (Backport PR #​44592, Upstream PR #​44540, @​tklauser)
• Fix a bug where removed addresses from EndpointSlices might be missed if multiple EndpointSlices share the same name (Backport PR #​44021, Upstream PR #​43999, @​EmilyShepherd)
• Fix envoy admin socket being created as world-accessible (Backport PR #​44592, Upstream PR #​44512, @​0xch4z)
• Fixed an issue where wildcard FQDN network policy identities were not correctly pushed to Envoy when using SNI-based policies. (Backport PR #​44519, Upstream PR #​44462, @​liyihuang)
• Fixed VTEP ARP responses returning 00:00:00:00:00:00 MAC due to interface MAC missing from eBPF Overlay configuration. (Backport PR #​44700, Upstream PR #​44513, @​akos011221)
• gateway-api: Fix hostname intersection bug that was preventing cert-manager challenges from working correctly. (Backport PR #​44519, Upstream PR #​44492, @​youngnick)
• l7lb: fix bypassing ingress policies for local backends (Backport PR #​44804, Upstream PR #​44693, @​smagnani96)
• loadbalancer/healthserver: refresh ProxyRedirect per request (Backport PR #​44399, Upstream PR #​44286, @​mhofstetter)

CI Changes:

• gh: e2e-upgrade: don't hardcode IPsec encryption algorithm (Backport PR #​44519, Upstream PR #​44381, @​julianwiedmann)

Misc Changes:

• chore(deps): update all github action dependencies (v1.18) (#​44372, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44480, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44579, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44681, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44791, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​44369, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​44580, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​44678, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.8 (v1.18) (#​44810, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.1 (v1.18) (#​44344, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.1 (v1.18) (#​44401, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.2 (v1.18) (#​44577, @​cilium-renovate[bot])
• chore(deps): update dependency sphinx-tabs to v3.5.0 (v1.18) (#​44679, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/ubuntu:24.04 docker digest to d1e2e92 (v1.18) (#​44476, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to e3f9456 (v1.18) (#​44797, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to f512d81 (v1.18) (#​44575, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.8 (v1.18) (#​44370, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.1 (v1.18) (#​44680, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663 (v1.18) (#​44371, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1771585526-532310e626e42c7086de4ef3ea913736125bbd31 (v1.18) (#​44478, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773220507-ffc0948a7ec4868e6b552a71cf4d3860e78b53cc (v1.18) (#​44676, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773405792-4046425704636ea5b770460c20c065069cf572dc (v1.18) (#​44789, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773656288-7b052e66eb2cfc5ac130ce0a5be66202a10d83be (v1.18) (#​44807, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44252, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44479, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44677, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44790, @​cilium-renovate[bot])
• Docs: improve docs around ipsec upgrade in 1.18 (Backport PR #​44399, Upstream PR #​44302, @​darox)
• fix(deps): update k8s.io patch updates stable (v1.18) (#​44477, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.33.9 (v1.18) (patch) (#​44578, @​cilium-renovate[bot])
• fix(deps): update sigs.k8s.io/mcs-api/controllers digest to 0f775a3 (v1.18) (#​44576, @​cilium-renovate[bot])
• fix(deps): update sigs.k8s.io/mcs-api/controllers digest to 15301c2 (v1.18) (#​44675, @​cilium-renovate[bot])
• loadbalancer/healthserver: stabilize proxy-redirect test (Backport PR #​44519, Upstream PR #​44323, @​mhofstetter)

Other Changes:

• [1.18] gha: Use eks 1.32 from us-west-2 (#​44753, @​sayboras)
• [v1.18] endpoint/bpf: remove change empty condition for updateEnvoy (#​44616, @​liyihuang)
• [v1.18] gh: verifier: disable RHEL8 (#​44317, @​julianwiedmann)
• [v1.18] loadbalancer: Fix flake in hybrid-dsr.txtar (#​44756, @​julianwiedmann)
• install: Update image digests for v1.18.7 (#​44326, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.8@​sha256:070a63cc414869cf6c53202cb50929a87adb7d5b25de0f2f40ab39eb6434b706

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.8@​sha256:5cb08daad7397f52ce5c36fcbfe83c56494f340d9b8f10f8bc7a3f2a812c33d5

docker-plugin

quay.io/cilium/docker-plugin:v1.18.8@​sha256:8e1c89bc4ef3bbc55a10edc96a9f2915af45181e46ff189c00f3d8fb7825a0b7

hubble-relay

quay.io/cilium/hubble-relay:v1.18.8@​sha256:dcf324aa35ab59c8fe6d002e3df6a63fff18280da464d09e4a97d58c085bb015

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.8@​sha256:36c1702c8afd0b0221e3d88ca08537100caef509de6a6bb7244d5fa4643a7252

operator-aws

quay.io/cilium/operator-aws:v1.18.8@​sha256:7ab154b269eae378456d63cc9085d96c4f472e11a1496ca4c62af68ff4b31da3

operator-azure

quay.io/cilium/operator-azure:v1.18.8@​sha256:a4027d349e817bda9168af1e27231be491a3026c748128a79026e366321f6332

operator-generic

quay.io/cilium/operator-generic:v1.18.8@​sha256:f9d1715932751b1454d0f59b492497cb1636dea6335beab0f9026fa8b5a6f62f

operator

quay.io/cilium/operator:v1.18.8@​sha256:cc3f7bdf9e443b807d3cb9b0bd30eddac5591c3f4b1e6fa053bfaa8697a7ee58

---

Configuration

📅 Schedule: Branch creation - "before 7am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.