fix(deps): update module github.com/cilium/cilium to v1.17.0-rc.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/cilium/cilium	v1.17.0-pre.3.0.20250108154004-47bb433883b2 -> v1.17.0-rc.2

---

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.17.0-rc.2: 1.17.0-rc.2

Compare Source

Summary of Changes

Major Changes:

• The Helm setting tls.secretsBackend is deprecated and should be replaced with the use of the tls.readSecretsOnlyFromSecretsNamespace setting instead. tls.secretsBackend will be removed in a future Cilium version. (Backport PR #​37232, Upstream PR #​37076, @​youngnick)

Minor Changes:

• Add IngressDeny and EgressDeny rules validation for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy (Backport PR #​37126, Upstream PR #​36598, @​pippolo84)
• bpf: Address backend selection under session affinity with Maglev (Backport PR #​37126, Upstream PR #​37005, @​borkmann)
• clustermesh: add dualstack support for MCS-API and fix a spec compliance issue with headless services (Backport PR #​37126, Upstream PR #​37053, @​MrFreezeex)
• doc: Added hostLegacyRouting limitation for Talos (Backport PR #​37126, Upstream PR #​36852, @​PhilipSchmid)
• Improves Network Policy validation and default deny behavior. Policies now require at least one of Ingress, IngressDeny, Egress, or EgressDeny to be defined. (Backport PR #​37247, Upstream PR #​35904, @​renyunkang)
• ingress: Remove multiple network device limitation (Backport PR #​37126, Upstream PR #​36769, @​sayboras)
• k8s: Bump k8s/kubectl to v0.32.0 (Backport PR #​37126, Upstream PR #​36827, @​sayboras)

Bugfixes:

• Allow cilium agent to start on linux kernels that don't have CONFIG_XFRM. (Backport PR #​37247, Upstream PR #​37123, @​julianwiedmann)
• clustermesh: fix MCS-API service export cache not properly deleted (Backport PR #​37126, Upstream PR #​36892, @​MrFreezeex)
• clustermesh: add support for targetPort in MCS-API (Backport PR #​37126, Upstream PR #​36875, @​MrFreezeex)
• envoy: add configurable access log buffer size (Backport PR #​37126, Upstream PR #​36823, @​aetimmes)
• Fix a bug that prevents a pod from accessing Nodeport services when the pod is also in scope of a broad-range Egress Gateway policy. (Backport PR #​37126, Upstream PR #​36929, @​julianwiedmann)
• Fix bug causing the endpoint regeneration failure handler to be effective only once (Backport PR #​37247, Upstream PR #​37085, @​giorio94)
• Fix bug potentially causing newly added endpoints to remain stuck in waiting-to-regenerate state forever, causing traffic from/to that endpoint to be incorrectly dropped. (Backport PR #​37126, Upstream PR #​37086, @​giorio94)
• Fix configuration of proxy-max-concurrent-retries (Backport PR #​37247, Upstream PR #​37061, @​joestringer)
• Fix memory leak caused by service events when when CNPs/CCNPs are disabled (Backport PR #​37126, Upstream PR #​36727, @​giorio94)
• fix: Hubble metrics not deleted for deleted pods (Backport PR #​37126, Upstream PR #​36819, @​rectified95)
• hubble: fix metrics configuration parsing (Backport PR #​37126, Upstream PR #​36371, @​kaworu)
• operator: don't reconcile non-GAMMA xRoutes without a Cilium-managed Gateway (Backport PR #​37126, Upstream PR #​35718, @​aetimmes)

CI Changes:

• .github: Set --interactive=false for cilium status (Backport PR #​37247, Upstream PR #​37151, @​joestringer)
• ci-e2e-upgrade: Cover wireguard + geneve tunnel (Backport PR #​37247, Upstream PR #​37163, @​jschwinger233)
• ci: add leak detection to conformance-ipsec-upgrade (Backport PR #​37169, Upstream PR #​36377, @​smagnani96)
• ci: more robust hubble relay service port-forwarding (Backport PR #​37247, Upstream PR #​37110, @​rolinh)
• gh: e2e-upgrade: use DSR-Geneve in config 15 (Backport PR #​37126, Upstream PR #​36982, @​julianwiedmann)
• gh: update removed --loglevel option for kind (Backport PR #​37126, Upstream PR #​36935, @​julianwiedmann)
• gha: Bump k8s version to v1.32.0 (Backport PR #​37126, Upstream PR #​36905, @​sayboras)
• gha: bump ubuntu version in conformance-externalworkloads (Backport PR #​37126, Upstream PR #​36859, @​giorio94)
• gha: correctly downgrade to patch release in ipsec workflows (Backport PR #​37126, Upstream PR #​36858, @​giorio94)
• gha: Retrieve eks supported version via aws cli (Backport PR #​37222, Upstream PR #​37210, @​sayboras)
• integration: Bump ubuntu to 24.04 for arm runners (Backport PR #​37126, Upstream PR #​37042, @​sayboras)
• Modify bpftrace script in CI to ignore proxy traffic if destination is outside pod CIDRs. (Backport PR #​37126, Upstream PR #​36364, @​smagnani96)
• Skip tracking unmarked plain-text TCP RST packets generated from proxy timeouts in the CI bpftrace script. (Backport PR #​37247, Upstream PR #​36962, @​smagnani96)
• test: Fix the flake for TestRestoredPort (Backport PR #​37247, Upstream PR #​37106, @​sayboras)
• test: Move demo-httpd from Docker to Quay (Backport PR #​37247, Upstream PR #​37149, @​joestringer)

Misc Changes:

• .github/build-images-ci: re-enable floating tags for stable branches (Backport PR #​37126, Upstream PR #​36913, @​aanm)
• [v1.17] deps: bump x/crypto to v0.31 and x/net to v0.33 (#​36958, @​ferozsalam)
• Add GOARCH to go install dlv command (Backport PR #​37126, Upstream PR #​36853, @​gyutaeb)
• build: Remove debug leftover from Makefile (Backport PR #​37126, Upstream PR #​36917, @​gentoo-root)
• chore(deps): update actions/setup-go action to v5.3.0 (v1.17) (#​37116, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (#​36948, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (#​37073, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​36916, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​37032, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​37115, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​37150, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.20 (v1.17) (#​37214, @​cilium-renovate[bot])
• chore(deps): update docker.io/alpine/socat docker tag to v1.8.0.1 (v1.17) (#​37071, @​cilium-renovate[bot])
• chore(deps): update go (v1.17) (#​37179, @​cilium-renovate[bot])
• chore(deps): update go to v1.23.5 (v1.17) (#​37044, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.31.5-1737074032-41faf0e6060077f7cccb8bb34a08eff4afde2ccd (v1.17) (#​37040, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.31.5-1737535524-fe8efeb16a7d233bffd05af9ea53599340d3f18e (v1.17) (#​37200, @​cilium-renovate[bot])
• cilium: minor hostport fixes (Backport PR #​37126, Upstream PR #​36856, @​borkmann)
• cli: Fix empty egress bandwidth and priority config display (Backport PR #​37247, Upstream PR #​37109, @​l1b0k)
• clustermesh: Add hidden flag --allow-unsafe-policy-skb-usage (Backport PR #​37126, Upstream PR #​36602, @​joestringer)
• clustermesh: update coredns version in mcs-api docs (Backport PR #​37126, Upstream PR #​36899, @​MrFreezeex)
• doc: ebpf host-routing and netfilter (Backport PR #​37126, Upstream PR #​36921, @​PhilipSchmid)
• doc: Removed nodeinit from aks byocni install (Backport PR #​37126, Upstream PR #​37048, @​PhilipSchmid)
• Docs: CiliumCIDRGroup updates & cleanups (Backport PR #​37126, Upstream PR #​37059, @​squeed)
• docs: Clarify Identity-Relevant Labels description (Backport PR #​37126, Upstream PR #​36924, @​joestringer)
• docs: pass current_version to html_context (Backport PR #​37126, Upstream PR #​37008, @​ayuspin)
• docs: remove some stale requirements (Backport PR #​37126, Upstream PR #​36861, @​julianwiedmann)
• docs: Remove stale limitation on KPR+IPsec (Backport PR #​37126, Upstream PR #​37054, @​pchaigno)
• docs: tuning: add config snippet for BPF Host Routing (Backport PR #​37126, Upstream PR #​36878, @​julianwiedmann)
• docs: Update L7 Port Range Information (Backport PR #​37126, Upstream PR #​36966, @​nathanjsweet)
• Endpoint policy before restoration (Backport PR #​37126, Upstream PR #​36433, @​jrajahalme)
• Fix make -C Documentation update-cmdref when make uses --jobserver-style=fifo. (Backport PR #​37126, Upstream PR #​36788, @​gentoo-root)
• localnodeconfig: dedup cluster routing mode (Backport PR #​37126, Upstream PR #​36932, @​julianwiedmann)
• make: Don't hide install errors (Backport PR #​37126, Upstream PR #​36980, @​joestringer)
• metrics: Use new style script flags (Backport PR #​37247, Upstream PR #​37088, @​joamaki)
• policy: Deprecating the toRequires and fromRequires fields in network policies. (Backport PR #​37126, Upstream PR #​36649, @​nathanjsweet)
• policy: reduce allocs by avoiding use of interface types, retire MapStateOwners (Backport PR #​37126, Upstream PR #​36798, @​jrajahalme)
• proxy: Mark restored port as configured (Backport PR #​37126, Upstream PR #​36953, @​jrajahalme)
• Remove outdated roadmap matrix and links to it (Backport PR #​37247, Upstream PR #​37170, @​xmulligan)
• watchers: demote "CEP deleted" log message to debug level (Backport PR #​37126, Upstream PR #​37081, @​giorio94)
• wireguard: attach Ingress program for native routing mode configurations (Backport PR #​37247, Upstream PR #​37108, @​julianwiedmann)

Other Changes:

• install: Update image digests for v1.17.0-rc.1 (#​36938, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.0-rc.2@​sha256:a0d21e7191f7635c05f5aeb977c19369adafe50365eca65cfe364615a6cb8fc6

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.0-rc.2@​sha256:77e5bf1a8048e7f21704168af3763e9d399170371c6b6ae762676b75b60c1add

docker-plugin

quay.io/cilium/docker-plugin:v1.17.0-rc.2@​sha256:3e00442c12837297aab287bb99dbb3c30d795dc638c9d051307cbd4a017e70ad

hubble-relay

quay.io/cilium/hubble-relay:v1.17.0-rc.2@​sha256:409333bf0a3224ce6e26073a5a46156b5b15357818582f32c5be4d7d7608033b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.0-rc.2@​sha256:a6b678e3e20954ee623dff5a49a27a40e17ba73b66ee364eb659c762658c20c8

operator-aws

quay.io/cilium/operator-aws:v1.17.0-rc.2@​sha256:3c5576e5a5bbedeede90ce684f9c3d99c9a675319a2c13c935f1b8245c1d3413

operator-azure

quay.io/cilium/operator-azure:v1.17.0-rc.2@​sha256:edee761954fbc5b1411aa7a270ee15e56074d462109b507aff1684d467d82742

operator-generic

quay.io/cilium/operator-generic:v1.17.0-rc.2@​sha256:13fcd5cbe871342bcbdc42dea9d72250c8e38cdd538ce049c5506a81f8f43b72

operator

quay.io/cilium/operator:v1.17.0-rc.2@​sha256:af7ef3aa16b39110a3f9e424a90f9b334ed31ebaf4235895fdf0392239b7cb51

v1.17.0-rc.1: 1.17.0-rc.1

Compare Source

Summary of Changes

Minor Changes:

• envoy: Use yaml format for bootstrap config (Backport PR #​36781, Upstream PR #​36820, @​sayboras)
• vendor: Bump gateway-api version to v1.2.1 (Backport PR #​36781, Upstream PR #​36773, @​sayboras)

Bugfixes:

• envoy: Configure internal address config based on IP family (Backport PR #​36781, Upstream PR #​36733, @​sayboras)

CI Changes:

• [v1.17] gh: replace kernel development trees with 6.12 kernel (#​36841, @​julianwiedmann)
• gha: Disable envoy version check in upgrade/downgrade tests (Backport PR #​36739, Upstream PR #​36734, @​sayboras)
• github: Fix branch name in build-go-caches.yaml (#​36906, @​michi-covalent)

Misc Changes:

• chore(deps): update all github action dependencies (v1.17) (#​36759, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​36724, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​36849, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.23 (v1.17) (#​36894, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.23.4 docker digest to 7ea4c9d (v1.17) (#​36848, @​cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.12.0 (v1.17) (#​36837, @​cilium-renovate[bot])
• chore(deps): update kindest/node docker tag to v1.29.12 (v1.17) (#​36758, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#​36722, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#​36836, @​cilium-renovate[bot])
• doc: fix typo on kubeproxy-free (CEV -> CVE) (Backport PR #​36739, Upstream PR #​36701, @​alagoutte)
• ingress, gateway-api: Convert test fixtures to file based (Backport PR #​36781, Upstream PR #​36732, @​sayboras)
• ingress, gateway-api: Convert test fixtures to file based (Backport PR #​36781, Upstream PR #​36810, @​sayboras)
• Remove reference to DNS polling (Backport PR #​36739, Upstream PR #​36679, @​JacobHenner)
• vendor: bump ebpf-go to 0.17 (Backport PR #​36781, Upstream PR #​36723, @​ti-mo)

Other Changes:

• [v1.17] gha: use /test to trigger tests in stable branches (#​36690, @​giorio94)
• install: Update image digests for v1.17.0-rc.0 (#​36693, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.0-rc.1@​sha256:a6e0b8285dc7979e89d2cec34fbd0c5997a459f1870ebd42c8ece3e061cf5f7e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.0-rc.1@​sha256:2b7b7d2b97f635f6fb8cc238f3d3c2243ad77148fd5bd926cd59d21a7d6d1154

docker-plugin

quay.io/cilium/docker-plugin:v1.17.0-rc.1@​sha256:1d28c407cf853a89231d2b07e1f4b74e033b6067f755844c1ef6fb3c34865d1f

hubble-relay

quay.io/cilium/hubble-relay:v1.17.0-rc.1@​sha256:c5dc43e38cd54b332787f7da273dcffaf8fb0fc17826dc27ee53d1a9f7a5ee91

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.0-rc.1@​sha256:ada65be66352e2be8bb1170039f80ef89bb84a77be386d0445761a442ccee666

operator-aws

quay.io/cilium/operator-aws:v1.17.0-rc.1@​sha256:4bf0d1caddc56a826b5ffc21db9494284c65cd5ca5e531b935140f366367a4a6

operator-azure

quay.io/cilium/operator-azure:v1.17.0-rc.1@​sha256:b2549f4216a27001614235388a0f793d7d0113e36f70eca72292ab8a3b40f36c

operator-generic

quay.io/cilium/operator-generic:v1.17.0-rc.1@​sha256:67ecfb0e0f752faa3a83dd85e6a94b921a1cdb37c1c34750e17d2344932153a8

operator

quay.io/cilium/operator:v1.17.0-rc.1@​sha256:e3fa5d66a5d88dcbdc5cd1644ab76dbbf58bdef12c6f5faccebc51fd32c845dc

---

Configuration

📅 Schedule: Branch creation - "on friday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/cilium/hive	v0.0.0-20241213121623-605c1412b9b3 -> v0.0.0-20250121145729-e67f66eb0375
sigs.k8s.io/mcs-api	v0.1.1-0.20241217092652-fede3192824f -> v0.1.1-0.20250116162235-62ede9a032dc