Cilium v1.18.13: Host Firewall VRRP And IPAM Fixes

Cilium v1.18.13 shipped on 18 August 2026 as a patch on the 1.18 line. The datapath change that matters is host firewall support for VRRP and IGMP, so keepalived peers and multicast control traffic can be classified instead of treated as unknown L4. The same tag backports a hostNetwork IP allocation bug, an ipcache CIDR refcount fix, and a Netlink hang in filterAndDestroySockets.

The full release notes and downloads are on the GitHub release page.

Keepalived, node VRRP daemons, and IGMP based multicast sit outside TCP and UDP. The 1.18 host firewall did not treat VRRP or IGMP as known protocols until this backport (cilium/cilium#47619, upstream cilium/cilium#39872).

That is the one major item in the notes. If the host firewall is off, skip it. If it is on, and nodes run VRRP or join multicast groups, this is the reason to pick v1.18.13 over v1.18.12.

The same backport carries a BPF hostfw fix: unknown conntrack protocols are tolerated and policy decides the verdict (cilium/cilium#47343). That pairing is not accidental. VRRP and IGMP were exactly the kind of traffic that used to land in the unknown protocol path. After the change, a protocol the CT map does not model is no longer a special case that can drop or stall independently of NetworkPolicy.

CI around this work is BPF policy tests plus IGMP coverage. Those tests do not change runtime config. They only show the project expected regressions in the host firewall path.

hostNetwork pods were able to trigger abnormal IP allocation (cilium/cilium#47552, backport cilium/cilium#47687). DaemonSets that bind the host stack should not consume a pod CIDR address. When they do, the pool shrinks, or a later pod gets a surprising address. Ordinary pipeline pods then wait on IPAM or come up on the wrong identity.

ipcache had a matching bookkeeping bug. The CIDR reference counter now keys on canonical prefixes (cilium/cilium#47208, backport cilium/cilium#47887). Two inserts of the same range with different string forms used to look like distinct entries. Refcount then drifted: a delete could drop the CIDR while another owner still held it, or a stale prefix could linger after the last owner left. Either failure shows up as policy that does not match, or as a CIDR that never leaves the map.

Neither fix is a config toggle. They are correctness patches. Clusters that churn hostNetwork DaemonSets or rewrite large CIDR identity sets are the ones that will notice.

Netlink errors inside filterAndDestroySockets could hang the agent (cilium/cilium#46967, backport cilium/cilium#47799). Socket teardown sits on the pod delete path. A stuck call stalls endpoint cleanup on that node, and new pods wait on CNI. The patch stops treating those Netlink errors as a hang.

cilium bugtool / sysdump grew host counters that already exist on the node and were missing from the tarball:

  • /proc/net/softnet_stat (softnet backlog and squeeze)
  • /proc/net/snmp and /proc/net/netstat (IPv4 host drops)
  • snmp6 and dev_snmp6 for IPv6 host drops

Those files are how you tell a host firewall drop from a NIC softnet stall. They do not fix packet loss. They make the next sysdump useful when a node is dropping on the host namespace rather than in a pod veth.

ICMP SNAT is now gated on BPF masquerading and on SNAT between clusters (cilium/cilium#47021). ICMP rewrite follows the same conditions as the rest of SNAT, rather than running on its own.

A late item in Other Changes adds DNS request checking before qname extraction (cilium/cilium#47385). FQDN policy parses DNS on the datapath. Checking the request before reading qname is a guard against malformed DNS, not a new policy knob.

Most of the changelog is Renovate and GitHub Actions. Go moves to v1.25.13. google.golang.org/grpc moves to v1.82.1 and is marked [security]. cilium-cli lands at v0.19.7. The cilium-envoy image tag was bumped twice on this line. Image scripts now validate Envoy variables against sed injection.

None of that is a cluster API change. Pin the published digest if you mirror images:

quay.io/cilium/cilium:v1.18.13@sha256:6e6e6a82a6a2a6d0bfe6dd7e36cb0222fa48135ad139ddc979b5c3c841e2db1a

CI work is flake control: retry CLI downloads, skip etcd log fetch when kvstore never started, Kind kvstore wait timeout, Cyclonus JUnit from a live log instead of a dead pod, a revert of skipping LLVM and Clang in integration tests. Read it as project hygiene, not as a reason to change Helm values.

No breaking change or migration step is listed. Treat v1.18.13 as a straight patch on 1.18. Read the GitHub release page for the image list (hubble-relay, operator-generic, clustermesh-apiserver, and the cloud operators).