chore(deps): cilium 1.19.6 -> 1.20.0

[stxkxs]

Its own change rather than part of a batch: this is the CNI, and 1.20 moves the Envoy proxy's configuration transport.

1.20.0 is GA (published 2026-07-29, prerelease=false), chart version tracks appVersion. The fleet is already on the newest 1.19 patch — what Cilium's upgrade docs require before crossing a minor — so this is one hop, not two.

What actually changes

Helm regenerates self-signed certs on every helm template run, which inflated my first diff to 154 lines of noise. Excluding those, the real changes:

• Envoy bootstrap moves from separate CDS/LDS gRPC config sources to ADS, with envoy-xds-mode: "ads" in the ConfigMap. This is the one change with behavioural surface here, because these values enable Hubble's httpV2 metrics, which run through that proxy.
• Eight additive ConfigMap keys, each at its upstream default: devices, enable-dynamic-source-lookup-nodeport, proxy-cluster-max-pending-requests, envoy-node-locality-enabled, envoy-access-log-enabled, clustermesh-default-global-namespace, enable-datapath-plugins, datapath-plugins-state-dir.
• RBAC drops ciliumbgppeeringpolicies and endpoints, gains ciliumdatapathplugins and serviceaccounts. The BGP removal is inert here — no CiliumBGPPeeringPolicy, bgpControlPlane setting or BGP reference exists anywhere in eks-gitops, kx or landing-zone.
• toGroups CNP permissions carry an upstream comment that the feature was removed in v1.20 and the grants stay until v1.21 for upgrade phasing.

No object added, removed or renamed. The chart ships values.schema.json in both versions, so a values key dropped upstream would have failed the render rather than being absorbed silently — it renders clean at 1.20.0 against this repo's base + production values.

task validate: 109 addon×env combinations, 0 failed.

IPv6 is untouched

1.20 ships IPv6 for AWS ENI IPAM as beta, and these values run exactly that path (ipam.mode=eni, routingMode=native). The release GA'ing satisfies "the minor is stable", not "the feature is GA", so landing-zone#152 stays parked on the feature.

Sequencing

kx mirrors this pin and follows in a paired change — mirror-check fails on either side moving alone.

Worth a decision before merging: this changes what a first end-to-end install would get. Nothing of the workload substrate is applied today, so there is no upgrade to perform and the two-consecutive-minors rule does not apply — but if the first e2e run is imminent, there is a case for letting it validate the currently-declared state rather than debugging a CNI minor and a first install at the same time.

[github-actions]

CI Results

Check	Status
Zero-placeholder gate	✅ success
YAML Lint	✅ success
Dashboard gate (live grafana.com ids + AMG-saveable)	✅ success
Kyverno policy tests (+ verify-images contract)	✅ success
Fork-safety gate (no hardcoded org, blocking)	✅ success
Helm-render (every addon × every env)	✅ success
Policy-admission (Enforce-tier Kyverno vs the fleet)	✅ success
ApplicationSet schema + sync waves	✅ success
Appset render (Karpenter subnet selector)	✅ success
Secret scan (gitleaks)	✅ success
Render + assert + schema + misconfig (all environments)	✅ success

All checks passed.

[stxkxs]

Holding the minor. Closing rather than parking an open PR that would rot against a moving base.

Two reasons, and the second is why this PR was wrong as written.

It puts a CNI minor in front of a fleet that has never been installed. Nothing of the workload substrate is applied, so the first e2e run is the first time any of this executes; validating a first install and a CNI minor at the same time makes a failure ambiguous.

And it moves only one of the two pins that decide a cluster's CNI version. landing-zone/components/aws/cluster-bootstrap/variables.tf installs Cilium on every bootstrapped cluster and then never touches it again (ignore_changes = all); this ApplicationSet owns it from the first sync, on everything except the hub. They were at 1.19.5 and 1.19.6. Merging this alone would have made a fresh cluster jump 1.19.5 → 1.20.0, which Cilium's upgrade documentation forbids — consecutive minors only, newest patch of the current one first. A dormant patch-level skew would have become a rule-violating minor jump on every install, with every gate in both repos green.

landing-zone#228 closes the skew at 1.19.6 instead, so both sides agree at the version already pinned here and this repo needs no change.

The 1.20.0 analysis in this PR stands and is worth keeping for whoever picks it up: Envoy moves to ADS (which matters here, since these values enable Hubble httpV2 metrics through that proxy), eight additive ConfigMap keys at upstream defaults, and RBAC dropping ciliumbgppeeringpolicies — inert, since no BGP reference exists in eks-gitops, kx or landing-zone. No object added, removed or renamed, and the chart ships values.schema.json in both versions so a dropped values key would have failed the render rather than being absorbed silently.

When it is taken up it must move both pins in one step. landing-zone#229 tracks the missing gate that would have caught this.