Cilium v1.17.18 - L7 Policy And IPAM Fixes

Cilium v1.17.18, published on July 16, 2026, fixes incorrect policy denials for traffic to L7 load balanced services when a remote identity changes. For operators running data services on Kubernetes, this is the change to assess first because the prior behavior could reject traffic that policy intended to permit. This is a regular release, not a prerelease.

The full release notes and downloads are on the GitHub release page.

The main bug fix targets traffic to services that use L7 load balancing. When a remote identity changed, Cilium could produce an incorrect policy denial. This is a datapath correctness problem, not a cosmetic control plane issue: requests permitted by the intended policy could still be rejected after the identity change.

The notes do not define the exact trigger sequence or claim broad impact. Operators should treat this as a focused risk for clusters that combine L7 service handling with remote identity changes, not as evidence that every policy path was affected. A useful regression check is to drive requests through an L7 load balanced service while endpoints or remote identities change, then inspect policy drops and application errors.

The release also corrects an incorrectly specified failure label value for policy_change_total. That defect caused unnecessary warnings. Removing that noise should make genuine policy failures easier to isolate, but it does not change the underlying policy model or add a new metric.

The multi pool IPAM fix concerns waiting behavior for a zero preallocation request. The source note contains awkward wording, so the safe reading is limited: the wait condition around zero preallocation changed. It does not document a new user facing flag, a pool sizing change, or a migration step.

Teams that depend on multi pool allocation should compare allocation latency and pending endpoint behavior before and after the upgrade. That check is more useful than inferring a broader semantic change from the short note.

BYOCNI loopback handling also changed. This item appears under miscellaneous changes and is described as a chore, rather than a bug fix. It still warrants a smoke test in BYOCNI clusters because loopback setup is part of pod network readiness. The release does not announce a related configuration key.

Several build changes make version information more consistent. CI binaries now receive the correct module version, while worktree builds receive the full Cilium version from the Makefile. The image build also limits gops compilation to the relevant platform and adjusts how the Cilium Envoy image value is sourced.

Most of the remaining entries are internal maintenance. They update GitHub Actions, base images, Go image digests, Kubernetes utilities, and cilium-cli to v0.19.5. These changes matter to teams that reproduce builds or audit the release supply chain, but the notes do not present them as datapath features.

The release publishes digest pinned manifests for Cilium, clustermesh-apiserver, hubble-relay, the Docker plugin, and each listed operator image. The main Cilium artifact is quay.io/cilium/cilium:v1.17.18@sha256:2f2c611db8de2f9c4846ee80fa3371617218dcd0cce42cf0d7d40b4d06458a23. Operators that mirror images can use the published digests to preserve the exact release artifacts.

One documentation correction covers the default value of ipv4-native-routing-cidr. The notes do not restate that value, so they provide no basis for treating this item as a runtime default change.