Summary of Changes

Bugfixes:

• AWS EC2: Fix ENI attachment on multi-network card instances with high-performance networking (EFA) setups (Backport PR #42744, Upstream PR #42512, @41ks)
• CiliumEnvoyConfig proxy ports are now restored on agent restarts. (Backport PR #43118, Upstream PR #43108, @jrajahalme)
• Do not opt-out Endpoint ID 1 from dnsproxy transparent mode. (Backport PR #42949, Upstream PR #42887, @jrajahalme)
• Fix a bug that would cause IPsec logs to incorrectly report the XFRM rules being processed as "Ingress" rules. (Backport PR #42827, Upstream PR #42640, @sjohnsonpal)
• Fix bug that could cause the agent to fail to add XFRM states when IPsec is enabled, thus preventing a proper startup. (Backport PR #42949, Upstream PR #42666, @pchaigno)
• Fix certain cases where LRPs with the skipRedirectFromBackend flag set were not correctly processed. (#42751, @aditighag)
• policy: Fix Endpoint Selector Policy Deadlock (Backport PR #42969, Upstream PR #38139, @nathanjsweet)
• policy: Fix rare bug that prevented two endpoints that shared the same identity from being simultaneously updated. (Backport PR #42969, Upstream PR #37910, @nathanjsweet)
• policy: Fix rare Endpoint Selector Policy Deadlock causing policies to not be updated with new identities (Backport PR #42969, Upstream PR #42306, @odinuge)

CI Changes:

• .github: Consistently clean up workers on start (Backport PR #43215, Upstream PR #39644, @joestringer)
• [v1.17] ci: bump ubuntu version for lint build commit workflow (#42842, @giorio94)
• bpf: test: egressgw: fix up ENABLE_MASQUERADE (Backport PR #42967, Upstream PR #42912, @julianwiedmann)
• ci: install libtinfo5 for clang in build commits workflow (#43142, @tklauser)
• Delete .github/workflows/build-images-hotfixes.yaml (Backport PR #42967, Upstream PR #42958, @sekhar-isovalent)
• gh: conn-disrupt: fix XFRM error checks (Backport PR #42765, Upstream PR #42724, @julianwiedmann)
• gh: ipsec-e2e: fix flaky connection disruptivity test (Backport PR #42850, Upstream PR #42780, @julianwiedmann)
• gha: additionally cleanup disk space in clustermesh upgrade workflow (Backport PR #42949, Upstream PR #42862, @giorio94)
• gha: wait for cert-manager CRDs to be ready in conformance clustermesh (Backport PR #42967, Upstream PR #42947, @giorio94)
• makefile: More reliable update-helm-values (Backport PR #42827, Upstream PR #42736, @devodev)

Misc Changes:

• .github/workflows: make adjustments for new GitHub workflow behavior (#43218, @aanm)
• .github/workflows: remove auto-requested reviewers (Backport PR #43345, Upstream PR #42952, @aanm)
• chore(deps): update all external docker images dependencies (v1.17) (#43053, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (#42685, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (#43269, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (#43324, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (patch) (#43321, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#42402, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.28 (v1.17) (#42772, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33.1 (v1.17) (#42808, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33.2 (v1.17) (#43189, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.11 (v1.17) (#43322, @cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to d80cd69 (v1.17) (#43319, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.10 docker digest to 7b13449 (v1.17) (#42806, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.11 docker digest to e3fb71a (v1.17) (#43320, @cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to 2b7c93f (v1.17) (#43185, @cilium-renovate[bot])
• chore(deps): update github artifact actions (v1.17) (#43325, @cilium-renovate[bot])
• chore(deps): update go to v1.24.11 (v1.17) (#43187, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#42807, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#42938, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#43038, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#43188, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#43323, @cilium-renovate[bot])
• docs: Add limitation about LB to same backend via multiple VIPs (Backport PR #42744, Upstream PR #42632, @brb)
• Documentation: host firewall: document emergency recovery (Backport PR #42949, Upstream PR #42776, @squeed)
• Minor improvements around certificate validation in etcd/clustermesh troubleshoot commands (Backport PR #42949, Upstream PR #42782, @giorio94)
• tools/slogloggercheck: remove tool added by renovate (#42738, @aanm)

Other Changes:

• [v1.17] deps: bump x/crypto to v0.45.0 (#43115, @ferozsalam)
• [v1.17] proxy: Bump envoy version to v1.34.11 (#43144, @sayboras)
• [v1.17] proxy: Bump envoy version to v1.34.12 (#43261, @sayboras)
• install: Update image digests for v1.17.10 (#42734, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.11@sha256:260f7892b1e554f57618022070960bfbb78fc7a679feb934299f907e47ea8992

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.11@sha256:cd298620390b388320b4e2178ab81f928160d410789eb590299e5d3877badace

docker-plugin

quay.io/cilium/docker-plugin:v1.17.11@sha256:b8561a129770de63b776e7b7d3d02b8e5bb332507a14757284e9423f45fb1224

hubble-relay

quay.io/cilium/hubble-relay:v1.17.11@sha256:e3fd2efae4563f06a15565af6c7e5b766ebb301b372acaa68e2f9184bafc98a6

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.11@sha256:312dc6c796c809255dee302eebc613909500c5fe153df3f3b025c067f44e03bd

operator-aws

quay.io/cilium/operator-aws:v1.17.11@sha256:363779644fc8a6d1f503140548fb3e8d0a861e27d2ee2ff4d86d75802beeea6e

operator-azure

quay.io/cilium/operator-azure:v1.17.11@sha256:0782670b423ae84bef6728dd8626e2a6bd0512737207aa128392d70450fe5418

operator-generic

quay.io/cilium/operator-generic:v1.17.11@sha256:dbd985d5b5602a4f2ae4aafd1332829bdd7d3bf452164b7288c90e3470590422

operator

quay.io/cilium/operator:v1.17.11@sha256:5158e04f5a4e6d1a60f56e1aa5c23db685edd22d54cad23a06441187a38272a5