Cilium v1.19.7: LoadBalancer Map Collision And NodePort Outage

Cilium v1.19.7 shipped on 18 August 2026 as a stable patch on the 1.19 line. The change that matters for clusters that expose Services on node addresses is a BPF load balancer map key collision: HostPort and NodePort expansion could overwrite a LoadBalancer frontend when the node IP matched the LoadBalancer external IP, and deleting that Service could stall NodePort for about 30 minutes.

The full release notes and downloads are on the GitHub release page.

k3s and RKE2 L2 ServiceLB often advertise a node address as the LoadBalancer external IP. That is the layout the notes call out.

HostPort and NodePort expansion could collide with a LoadBalancer frontend in the BPF LB map when those addresses matched. The LoadBalancer frontend then vanished from the datapath. After a delete of a LoadBalancer whose external IP was a node address and whose port sat inside the NodePort range, NodePort traffic could stay unreachable for about 30 minutes. That is a long outage for a Service delete.

The backport is cilium/cilium#47414, from upstream cilium/cilium#45314. Data plane jobs that front HTTP scrapers, batch workers, or message consumers through L2 ServiceLB on k3s should treat this as the reason to roll the tag.

A second handoff bug shipped in the same backport. With KPR disabled, Cilium still intercepted traffic toward LoadBalancer VIPs. That traffic is supposed to go to kube-proxy. Upstream is cilium/cilium#47204. Clusters that left kube proxy replacement off and then wondered why Cilium owned LB VIP packets are the audience.

On the control plane side, lbipam could reassign a Service LoadBalancer IP on operator restart even when the existing IP still belonged to a compatible sharing key group. That is cilium/cilium#46262, backported as cilium/cilium#46559. Shared LoadBalancer IPs need an operator restart test on this tag; the winner is stable allocation, the loser is any runbook that assumed a restart was a no op for IPAM.

On EKS ENI IPAM the agent logged a spurious “unable to find ifindex for interface MAC” warning. It configured ingress routes and rules before the ENI netlink interface existed. The agent now waits for that interface first. Upstream cilium/cilium#47295, backport cilium/cilium#47545.

A separate IPAM bug allocated addresses incorrectly for hostnetwork pods (cilium/cilium#47552). Extra IPs on nodes that run hostNetwork workloads are the symptom to match.

ipcache now counts CIDR references using canonical prefixes (cilium/cilium#47208). Same map, fewer mismatches when the same CIDR is written in different forms. Restored endpoints with verbose policy logging could crash the endpoint manager; that crash is gone (cilium/cilium#47844). Verbose policy logs on restart are safe again; the cost is that you still pay for the log volume.

When cilium-envoy fails to bind because the port is already taken, Cilium Ingress now reallocates a port and retries (cilium/cilium#42859). Ingress comes up more often. A conflicting listener can stay hidden until you read bind logs, so the retry is recovery, not a root cause fix.

An invalid regex on an HTTPRoute or GRPCRoute matcher was stored as valid and then caused Envoy to NACK the config. The API now rejects that matcher instead of poisoning the data plane (cilium/cilium#47005). GAMMA Routes are filtered before model ingestion, so mesh routes that should not be ingested no longer reach Envoy.

The Envoy integration restores http-idle-timeout as the source for the route idle timeout (cilium/cilium#47583). If idle timeouts on HTTP routes looked wrong after a 1.19 upgrade, retest on v1.19.7.

CiliumEgressGatewayPolicy redirection was wrong when the first interface was L3, meaning no MAC (cilium/cilium#45703). Egress gateway on L3 devices is the topology that should recheck SNAT and redirect after the roll.

FQDN policy gained a DNS request check before qname extraction (cilium/cilium#47383). That is a guard on the name parse path, not a new policy feature. fqdn/service also prunes the SDP identity to IP mapping on delete using newID (cilium/cilium#47100).

Kernels older than v5.12 could reject the datapath when IPv6 was enabled (cilium/cilium#47765). The rest of that backport is stack accounting: never allocate ct_buffers on the stack, move the IPv6 NAT entry into a map, and cut stack use in ct_create{4,6} and tail_handle_snat_fwd_ipv6. If you still run IPv6 on kernels before v5.12, this is the load failure to recheck after the agent restart.

sysdump now collects /proc/net/softnet_stat, /proc/net/snmp, and /proc/net/netstat so host level packet drops are in the tarball (cilium/cilium#46985). bugtool also picks up snmp6 and dev_snmp6.

Most of the remaining changelog is CI: race images on push for stable branches, verifier workflow status, renovate flakes, and image digest pins. Those do not change cluster behavior.

The agent image is quay.io/cilium/cilium:v1.19.7 (sha256:1b58bcb81c723cf130a0dd2fb2e1132c57f8fbc2ef7bdb85519cfcc36111c77e). Operator and hubble-relay tags match the same version on quay.io/cilium.