From 1683d0431e20b1c7319886c18c38c7a177ec1ca0 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 14:44:35 +0000
Subject: [PATCH 1/2] chore(t8s-cluster/dependencies): update helm release
 cilium to v1.19.0

---
 charts/t8s-cluster/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/t8s-cluster/values.yaml b/charts/t8s-cluster/values.yaml
index e9274cf7f0..39f2929cb3 100644
--- a/charts/t8s-cluster/values.yaml
+++ b/charts/t8s-cluster/values.yaml
@@ -4,7 +4,7 @@ global:
     cilium:
       url: https://helm.cilium.io
       charts:
-        cilium: 1.18.6
+        cilium: 1.19.0
       condition: '{{ eq (include "t8s-cluster.cni" .) "cilium" }}'
     nvidia:
       url: https://helm.ngc.nvidia.com/nvidia

From b15b943046b4243c4d76f537d52e5b2d01403957 Mon Sep 17 00:00:00 2001
From: Chris Werner Rau <cwr@teuto.net>
Date: Thu, 5 Feb 2026 10:12:44 +0100
Subject: [PATCH 2/2] chore: use new feature ICMP response for policy denied
 traffic chore: use new OCI registry as chart source

---
 charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml | 2 ++
 charts/t8s-cluster/values.yaml                                | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml b/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml
index 827858a411..69def5d160 100644
--- a/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml
+++ b/charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml
@@ -59,6 +59,8 @@ spec:
     ipv4NativeRoutingCIDR: 10.0.0.0/16 # default net, see hosted control plane controller
     {{- end }}
 
+    policyDenyResponse: icmp
+
     rollOutCiliumPods: true
     encryption:
       enabled: false
diff --git a/charts/t8s-cluster/values.yaml b/charts/t8s-cluster/values.yaml
index 39f2929cb3..f0b60c4cb6 100644
--- a/charts/t8s-cluster/values.yaml
+++ b/charts/t8s-cluster/values.yaml
@@ -2,7 +2,7 @@ global:
   # it's important that the `url` is the first key and `charts` is right below, otherwise renovate won't detect it
   helmRepositories:
     cilium:
-      url: https://helm.cilium.io
+      url: oci://quay.io/cilium/charts
       charts:
         cilium: 1.19.0
       condition: '{{ eq (include "t8s-cluster.cni" .) "cilium" }}'