From ace96af930e8cabbc34819013e0af83c850dbb65 Mon Sep 17 00:00:00 2001
From: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Date: Thu, 6 Aug 2026 16:56:54 +0330
Subject: [PATCH] Upgrade cilium from 1.19.6 to 1.20.0 (#13401)

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---
 README.md                                           | 2 +-
 docs/CNI/cilium.md                                  | 2 +-
 roles/kubespray_defaults/defaults/main/download.yml | 6 +++---
 roles/kubespray_defaults/vars/main/checksums.yml    | 2 ++
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index d7e7189bb..bec4e75a4 100644
--- a/README.md
+++ b/README.md
@@ -119,7 +119,7 @@ Note:
 - Network Plugin
   - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
   - [calico](https://github.com/projectcalico/calico) 3.31.6
-  - [cilium](https://github.com/cilium/cilium) 1.19.6
+  - [cilium](https://github.com/cilium/cilium) 1.20.0
   - [flannel](https://github.com/flannel-io/flannel) 0.28.4
   - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
   - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
diff --git a/docs/CNI/cilium.md b/docs/CNI/cilium.md
index 79a0e142f..da2e6797a 100644
--- a/docs/CNI/cilium.md
+++ b/docs/CNI/cilium.md
@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version
 
 ```yml
-cilium_version: "1.19.6"
+cilium_version: "1.20.0"
 ```
 
 ## Add variable to config
diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 0a7d25425..4c2161d02 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -116,7 +116,7 @@ flannel_version: 0.28.4
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"
 
-cilium_version: "1.19.6"
+cilium_version: "1.20.0"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false
 
@@ -239,13 +239,13 @@ cilium_operator_image_tag: "v{{ cilium_version }}"
 cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay"
 cilium_hubble_relay_image_tag: "v{{ cilium_version }}"
 cilium_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
-cilium_certgen_image_tag: "v0.4.6"
+cilium_certgen_image_tag: "v0.4.8"
 cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui"
 cilium_hubble_ui_image_tag: "v0.13.5"
 cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
 cilium_hubble_ui_backend_image_tag: "v0.13.5"
 cilium_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
-cilium_envoy_image_tag: "v1.37.2-1778236003-7c2f6580d32e50f1a6866c12122662856f54eec2"
+cilium_envoy_image_tag: "v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004"
 kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
 kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
 kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml
index 9cfbe44d9..dd430ae84 100644
--- a/roles/kubespray_defaults/vars/main/checksums.yml
+++ b/roles/kubespray_defaults/vars/main/checksums.yml
@@ -549,6 +549,7 @@ calicoctl_binary_checksums:
     3.29.0: sha256:c9c2a29a349c6f681aa79b5f5d6aee738305d95aa7f158b6217f487808758e53
 ciliumcli_binary_checksums:
   arm64:
+    0.19.7: sha256:9482937f14061fb239f2dbb2f97f4103de1b101f5d5defbff319f294f9bd540f
     0.19.6: sha256:fe8140aaaa561b7d59d8c0e7eef169c298b2d558924934c95aab8bb81382296f
     0.19.5: sha256:5498defafc248160ca44a38be39f5ba090769ef112f9ec34a19e72dfa7e7eb25
     0.19.4: sha256:866c86683aa63c943a94ca2af5dc2b0db3483d1c3ed8c72baeeabd13061a7e42
@@ -592,6 +593,7 @@ ciliumcli_binary_checksums:
     0.16.1: sha256:07f3f2ba4d772140e46004ee7fa239134acc27afc4f79fc301ee7037617babc1
     0.16.0: sha256:fe16bcd447fc6fe764ca75712f5832d7504845e9f782684ff09c9f52548237fe
   amd64:
+    0.19.7: sha256:cd15e0983bf0acc7946cd05d453d1e58376ea92dec2642e745212df2b07d8852
     0.19.6: sha256:65ae7592ab873acc0b242b8e679e0a0a856255e34fdd0082e7b048b6285a9842
     0.19.5: sha256:67e59489b7ad17dea8eb8cc930435105dff3a4575643ad62567fb2c5ae80d246
     0.19.4: sha256:98ecd554591a592b0ee32f5d73871133bcee06639619f1c032bcba339340dc26