fix(cilium): upgrade Cilium 1.18 → 1.19.4 (hop 3 of 3)#209
Merged
Conversation
Bump cilium_chart_version 1.18.10 → 1.19.4 and gateway_api_version v1.3.0 → v1.4.1 — the final hop of the staged upgrade tracked in #196. Cilium 1.19 is the closest minor to the cluster's Kubernetes 1.36 (e2e-tested to k8s 1.35, one minor behind) and supports Gateway API v1.4.1. Reviewed the 1.18→1.19 upgrade notes against cilium.tf: - CiliumLoadBalancerIPPool was promoted to the cilium.io/v2 API group; bumped the lab-pool resource off the now-deprecated v2alpha1. v2 is the CRD storage version and the spec schema is unchanged. CiliumL2AnnouncementPolicy stays v2alpha1 — 1.19 has not promoted it. - No removed or renamed Helm values are set in this root. kubeProxyReplacement is already the modern `true` form; the removed --enable-node-port / --enable-host-port / --enable-external-ips flags are not used. - Strict IPsec/WireGuard modes: neither encryption mode is enabled here, so the 1.19 strict-mode changes do not apply. The terraform_data.cilium_envoy_resync mitigation is kept. Its removal is gated on verifying L7 proxy-port stability across a cilium-agent restart once hop 3 is applied — a runtime check, tracked as a follow-up. Refs: #196 Closes: #198 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
Terraform plan:
|
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hop 3 — the final hop of the staged Cilium upgrade tracked in #196. Lands the cluster on Cilium 1.19.x, the closest minor to Kubernetes 1.36.
cilium_chart_version1.18.10→1.19.4gateway_api_versionv1.3.0→v1.4.1(Cilium 1.19 supports Gateway API v1.4.1)1.18 → 1.19 upgrade-notes review
Reviewed the upstream 1.18→1.19 upgrade notes against this bootstrap root:
CiliumLoadBalancerIPPoolpromoted tocilium.io/v2. The upgrade notes call out moving off the now-deprecatedv2alpha1. Bumped thelab-poolresource —v2is the CRD storage version and the spec schema (blocksofstart/stop) is unchanged.CiliumL2AnnouncementPolicystaysv2alpha1; 1.19 has not promoted that kind.kubeProxyReplacementis already the moderntrueform; the removed--enable-node-port/--enable-host-port/--enable-external-ipsflags are not used.cilium.tf, so the 1.19 strict-mode changes do not apply — confirmed per the issue.On
terraform_data.cilium_envoy_resyncThe L7 proxy-port resync mitigation is kept in this PR. Removing it is conditional on the issue's runtime check — "verify L7 proxy-port stability across a
cilium-agentrestart; if stable on 1.19, remove the resource" — which can only be done aftertofu applylands hop 3 on the live cluster. That re-evaluation is tracked as a follow-up (see #198 comment) rather than removed speculatively, since dropping the mitigation while proxy ports are still unstable would blackhole thelabGateway on every future apply.Validation
tofu validate— passestofu fmt— cleantofu apply,tofu plan(No changes), andjust smokeare operator-driven post-merge, matching hops fix(cilium): upgrade Cilium 1.16.5 → 1.17.16 (hop 1 of 3) #199 / fix(cilium): upgrade Cilium 1.17 → 1.18.10 (hop 2 of 3) #204.Note on Kubernetes 1.36
Cilium 1.19 is e2e-tested to k8s 1.35 — one minor behind the cluster's 1.36. A fully-tested pairing needs Cilium 1.20 once it lists k8s 1.36; tracked separately.
Refs: #196
Closes: #198
🤖 Generated with Claude Code