From ef7f1e3b6b0af87a95091adccff6f6c539288852 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Sat, 8 Aug 2026 13:04:43 -0700
Subject: [PATCH] chore(deps): cilium 1.19.6 -> 1.20.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Its own change rather than part of a batch: this is the CNI, and 1.20 moves the
Envoy proxy's configuration transport.

1.20.0 is GA, published 2026-07-29 with prerelease=false, and chart version
tracks appVersion. The fleet is already on the newest 1.19 patch, which is what
Cilium's upgrade documentation requires before crossing a minor, so this is one
hop and not two.

What actually changes in the rendered output, once Helm's freshly generated
self-signed certificates are excluded — they differ on every template run and
inflate the diff to nearly nothing but noise:

  - The Envoy bootstrap moves from separate CDS/LDS gRPC config sources to ADS,
    with a matching `envoy-xds-mode: "ads"` in the ConfigMap. This is the one
    change with behavioural surface here, because these values enable Hubble's
    httpV2 metrics, which run through that proxy.
  - Eight additive ConfigMap keys, each at its upstream default: devices,
    enable-dynamic-source-lookup-nodeport, proxy-cluster-max-pending-requests,
    envoy-node-locality-enabled, envoy-access-log-enabled,
    clustermesh-default-global-namespace, enable-datapath-plugins,
    datapath-plugins-state-dir.
  - RBAC drops `ciliumbgppeeringpolicies` and `endpoints`, and gains
    `ciliumdatapathplugins` and `serviceaccounts`. The BGP removal is inert
    here: no CiliumBGPPeeringPolicy, bgpControlPlane setting or BGP reference
    exists anywhere in eks-gitops, kx or landing-zone.
  - The toGroups CNP permissions carry an upstream comment that the feature was
    removed in v1.20 and the grants stay until v1.21 for upgrade phasing.

No object is added, removed or renamed. The chart ships values.schema.json in
both versions, so a values key dropped upstream would have failed the render
rather than being absorbed in silence; it renders clean at 1.20.0 against this
repo's own base and production values.

IPv6 is untouched and stays parked. 1.20 ships IPv6 for AWS ENI IPAM as beta,
and these values run exactly that path (ipam.mode=eni, routingMode=native), so
the release GA'ing satisfies "the minor is stable" and not "the feature is GA".

kx mirrors this pin and follows in a paired change.
---
 applicationsets/addons-networking.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applicationsets/addons-networking.yaml b/applicationsets/addons-networking.yaml
index 5876923..dd71b12 100644
--- a/applicationsets/addons-networking.yaml
+++ b/applicationsets/addons-networking.yaml
@@ -27,7 +27,7 @@ spec:
                   namespace: kube-system
                   chartRepo: https://helm.cilium.io
                   chart: cilium
-                  chartVersion: 1.19.6
+                  chartVersion: 1.20.0
                   path: addons/networking/cilium
                   syncWave: "1"
                 - appName: aws-load-balancer-controller