bpf, dbg: add vtep policy for flexible routing from/to outside world

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "Cilium",
-  "image": "quay.io/cilium/cilium-builder:dce64df3892bec24c003f97edcb8aae51640d97d@sha256:dbcda5ef242a9f5f138b733dbf22437c4134106dad6127041653f947b81e5367",
+  "image": "quay.io/cilium/cilium-builder:f5e2620e352d7bc93f5fa2e2309786102e73c014@sha256:5afb2abd71a4725003c967ee47d9555df10da1e754c07ffc48dfa8e615b83fd5",
   "workspaceFolder": "/go/src/github.com/cilium/cilium",
   "workspaceMount": "source=${localWorkspaceFolder},target=/go/src/github.com/cilium/cilium,type=bind",
   "features": {

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -24,11 +24,11 @@ body:
         **NOTE: If your version is NOT listed then please upgrade before opening the GH issue. Thank you**
       options:
         # renovate: datasource=github-tags depName=cilium/cilium
-        - 'equal or higher than v1.18.1 and lower than v1.19.0'
+        - 'equal or higher than v1.18.2 and lower than v1.19.0'
         # renovate: datasource=github-tags depName=cilium/cilium
         - 'equal or higher than v1.17.7 and lower than v1.18.0'
         # renovate: datasource=github-tags depName=cilium/cilium
-        - 'equal or higher than v1.16.13 and lower than v1.17.0'
+        - 'equal or higher than v1.16.14 and lower than v1.17.0'
     validations:
       required: true
   - type: textarea

.github/actions/e2e/configs.yaml

@@ -8,23 +8,23 @@
   misc: 'bpfClockProbe=false,cni.uninstall=false,tls.readSecretsOnlyFromSecretsNamespace=false,tls.secretSync.enabled=false'
 - name: '2'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'disabled'
   host-fw: 'true'
   misc: 'bpfClockProbe=false,cni.uninstall=false,tls.readSecretsOnlyFromSecretsNamespace=false,tls.secretSync.enabled=false'
 - name: '3'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'disabled'
   endpoint-routes: 'true'
   kvstore: 'true'
 - name: '4'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -36,7 +36,7 @@
   ingress-controller: 'true'
 - name: '5'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.15-20250812.093650'
+  kernel: '5.15-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -49,7 +49,7 @@
   ingress-controller: 'true'
 - name: '6'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.1-20250812.093650'
+  kernel: '6.1-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -63,7 +63,7 @@
   bgp-control-plane: 'true'
 - name: '7'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -78,7 +78,7 @@
   misc: 'bpfClockProbe=false,cni.uninstall=false,tls.secretsBackend=k8s,tls.secretSync.enabled=true'
 - name: '8'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'geneve'
@@ -89,7 +89,7 @@
   skip-include-conn-disrupt-test-ns-traffic: 'true'
 - name: '9'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -103,7 +103,7 @@
   ingress-controller: 'true'
 - name: '10'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.15-20250812.093650'
+  kernel: '5.15-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'disabled'
@@ -116,7 +116,7 @@
   kvstore: 'true'
 - name: '11'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.1-20250812.093650'
+  kernel: '6.1-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -132,7 +132,7 @@
   node-local-dns: 'true'
 - name: '12'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -157,7 +157,7 @@
   # explains why 5.4 might cause north-south-loadbalancing tests to
   # fail.
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.15-20250812.093650'
+  kernel: '5.15-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -169,7 +169,7 @@
   ingress-controller: 'true'
 - name: '15'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -181,7 +181,7 @@
   ciliumendpointslice: 'true'
 - name: '16'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.15-20250812.093650'
+  kernel: '5.15-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -195,7 +195,7 @@
   ingress-controller: 'true'
 - name: '17'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit,enableIPv4BIGTCP=true,enableIPv6BIGTCP=true'
   kube-proxy: 'none'
   kpr: 'true'
@@ -206,7 +206,7 @@
   ingress-controller: 'true'
 - name: '18'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit-l2,enableIPv4BIGTCP=true,enableIPv6BIGTCP=true'
   kube-proxy: 'none'
   kpr: 'true'
@@ -217,7 +217,7 @@
   ingress-controller: 'true'
 - name: '19'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit'
   kube-proxy: 'none'
   kpr: 'true'
@@ -228,7 +228,7 @@
   kvstore: 'true'
 - name: '20'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit-l2'
   kube-proxy: 'none'
   kpr: 'true'
@@ -238,7 +238,7 @@
   ingress-controller: 'true'
 - name: '21'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit'
   kube-proxy: 'none'
   kpr: 'true'
@@ -248,7 +248,7 @@
   ingress-controller: 'true'
 - name: '22'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit-l2'
   kube-proxy: 'none'
   kpr: 'true'
@@ -258,7 +258,7 @@
   ingress-controller: 'true'
 - name: '23'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit'
   kube-proxy: 'none'
   kpr: 'true'
@@ -270,7 +270,7 @@
   host-fw: 'true'
 - name: '24'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit,enableIPv4BIGTCP=true,enableIPv6BIGTCP=true'
   kube-proxy: 'none'
   kpr: 'true'
@@ -283,7 +283,7 @@
   ingress-controller: 'true'
 - name: '25'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   misc: 'bpf.datapathMode=netkit-l2,enableIPv4BIGTCP=true,enableIPv6BIGTCP=true'
   kube-proxy: 'none'
   kpr: 'true'
@@ -296,7 +296,7 @@
   ingress-controller: 'true'
 - name: '26'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.6-20250812.093650'
+  kernel: '6.6-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -307,7 +307,7 @@
   ingress-controller: 'true'
 - name: '27'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.6-20250812.093650'
+  kernel: '6.6-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -318,7 +318,7 @@
   ingress-controller: 'true'
 - name: '28'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.6-20250812.093650'
+  kernel: '6.6-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -330,7 +330,7 @@
   ingress-controller: 'true'
 - name: '29'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -343,7 +343,7 @@
   skip-upgrade: 'true'
 - name: '30'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -354,7 +354,7 @@
   ingress-controller: 'true'
 - name: '31'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -366,7 +366,7 @@
   ingress-controller: 'true'
 - name: '32'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.15-20250812.093650'
+  kernel: '5.15-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -378,7 +378,7 @@
   skip-upgrade: 'true'
 - name: '33'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   ipv6: 'true'

.github/actions/e2e/ipsec_configs.yaml

@@ -9,7 +9,7 @@
   key-two: 'rfc4106-gcm-aes'
 - name: 'ipsec-2'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'disabled'
@@ -18,7 +18,7 @@
   key-two: 'cbc-aes-sha256'
 - name: 'ipsec-3'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'disabled'
@@ -29,7 +29,7 @@
   kvstore: 'true'
 - name: 'ipsec-4'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'geneve'
@@ -40,7 +40,7 @@
   kvstore: 'true'
 - name: 'ipsec-5'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -51,7 +51,7 @@
   key-two: 'cbc-aes-sha256'
 - name: 'ipsec-6'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.10-20250812.093650'
+  kernel: '5.10-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -65,7 +65,7 @@
   key-two: 'rfc4106-gcm-aes'
 - name: 'ipsec-7'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '5.15-20250812.093650'
+  kernel: '5.15-20250917.183741'
   kube-proxy: 'iptables'
   kpr: 'false'
   tunnel: 'vxlan'
@@ -76,7 +76,7 @@
   skip-upgrade: 'true'
 - name: 'ipsec-8'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'
@@ -89,7 +89,7 @@
   key-two: 'rfc4106-gcm-aes'
 - name: 'ipsec-9'
   # renovate: datasource=docker depName=quay.io/lvh-images/kind
-  kernel: '6.12-20250812.093650'
+  kernel: '6.12-20250917.183741'
   kube-proxy: 'none'
   kpr: 'true'
   devices: '{eth0,eth1}'

.github/actions/eks/k8s-versions.yaml

@@ -9,10 +9,8 @@ include:
   - version: "1.32"
     region: ca-central-1
     default: true
-    ipsec: true
     kpr: true
     aws-eni-pd: true
   - version: "1.33"
     region: us-east-1
-    ipsec: true
     default: true

.github/actions/ginkgo/main-focus.yaml

@@ -247,7 +247,7 @@ exclude:
   - k8s-version: "1.32"
     focus: "f11-datapath-service-ns-tc"
 
-  - k8s-version: "1.28"
+  - k8s-version: "1.32"
     focus: "f12-datapath-service-ns-misc"
 
   - k8s-version: "1.32"