<p>The release of Cilium 1.19 marks a significant milestone, commemorating ten years of advancements in eBPF-based networking and security. This latest version emphasizes robust security measures and enhanced operational transparency rather than featuring a singular flagship innovation.</p>
<h3>Key Security Enhancements</h3>
<p>Cilium 1.19 introduces stringent modes for IPsec and WireGuard, designed to eliminate unencrypted inter-node traffic. Additionally, the integration with Ztunnel, currently in beta, facilitates a sidecar-free ambient mesh for mutual authentication within Kubernetes clusters, offering a scalable and secure networking model.</p>
<h3>Policy and Connectivity Upgrades</h3>
<p>To bolster connectivity security, the latest release enforces safer multi-cluster policy defaults, restricting cross-cluster traffic unless specifically permitted. In alignment with modern network policy requirements, the release includes BPF Host Routing compatibility with IPsec for encrypted high-performance traffic, along with support for Gateway API v1.4 including native GRPCRoute.</p>
<h3>IPAM and IPv6 Progress</h3>
<p>A noteworthy advancement in this release is the stabilization of Multi Pool IPAM, which now supports label selectors, masquerade tuning, and IPsec compatibility, enhancing IP address management for large or segmented deployments. Additionally, progress in IPv6 connectivity has been made with support for L2 announcements via Neighbor Discovery and dual-stack tunneling underlays.</p>
<h3>Observability with Hubble</h3>
<p>Hubble observability gains significant enhancements, featuring IP packet tracing via IP options, encryption-status filtering, and drop attribution to specific network policies. More improvements include Hubble flow log aggregation that minimizes export volume, allowing for more efficient monitoring.</p>
<h3>Networking Protocol and Configuration Enhancements</h3>
<p>Enhancements in protocol support include host firewall provisions for VRRP and IGMP protocols, and configurable ICMP responses for denied egress. DNS policies are now more flexible with support for wildcards using the <code>**.</code> prefix, enabling multi-level subdomain matching.</p>
<h3>BGP and Helm Chart Developments</h3>
<p>BGP protocol improvements add interface address advertisement, stable source IP binding, and the withdrawal of empty service routes. In addition, Helm charts are now available as OCI artifacts, streamlining deployment processes.</p>
<h3>Community and Contribution Highlights</h3>
<p>This release, comprising 2,934 commits from over 1,010 developers, underscores Cilium’s robust community and its standing as the second largest CNCF project by contributions, just behind Kubernetes. Cilium’s prevalence is further illustrated by its deployment in over 60% of surveyed production Kubernetes environments, solidifying its critical role in modern cloud-native infrastructures.</p>


Collections

Cilium 1.19 has been released, marking ten years of eBPF-based networking and security. Key highlights include strict IPsec and WireGuard modes to eliminate unencrypted inter-node traffic, beta Ztunnel integration for sidecar-free ambient mesh, and safer multi-cluster policy defaults. Multi Pool IPAM is now stable with label selector support and IPsec compatibility. Hubble observability gains IP packet tracing, encryption-status filtering, and flow log aggregation. Additional improvements cover BGP interface address advertisement, Gateway API v1.4 with GRPCRoute support, IPv6 L2 announcements via Neighbor Discovery, and Helm charts as OCI artifacts. The release includes 2,934 commits from over 1,010 contributors, reinforcing Cilium's position as the second largest CNCF project by contributions.

Celebrating Cilium 1.19: Enhanced Security, IPAM Stability, and Advanced Observability for Kubernetes