From ddb6ee50d95e7490a444dfe305e51d2d3e96c2be Mon Sep 17 00:00:00 2001
From: Ali Afsharzadeh <afsharzadeh8@gmail.com>
Date: Wed, 16 Sep 2026 17:31:23 +0330
Subject: [PATCH] Upgrade cilium from 1.20.1 to 1.20.2 (#13515)

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
---
 README.md                                           |  2 +-
 docs/CNI/cilium.md                                  |  2 +-
 roles/kubespray_defaults/defaults/main/download.yml | 10 +++++-----
 roles/kubespray_defaults/vars/main/checksums.yml    |  2 ++
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index dfcf056fa..ae5011ced 100644
--- a/README.md
+++ b/README.md
@@ -119,7 +119,7 @@ Note:
 - Network Plugin
   - [cni-plugins](https://github.com/containernetworking/plugins) 1.9.1
   - [calico](https://github.com/projectcalico/calico) 3.31.7
-  - [cilium](https://github.com/cilium/cilium) 1.20.1
+  - [cilium](https://github.com/cilium/cilium) 1.20.2
   - [flannel](https://github.com/flannel-io/flannel) 0.28.9
   - [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
   - [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
diff --git a/docs/CNI/cilium.md b/docs/CNI/cilium.md
index 73951cb07..245a2282d 100644
--- a/docs/CNI/cilium.md
+++ b/docs/CNI/cilium.md
@@ -245,7 +245,7 @@ cilium_operator_extra_volume_mounts:
 ## Choose Cilium version
 
 ```yml
-cilium_version: "1.20.1"
+cilium_version: "1.20.2"
 ```
 
 ## Add variable to config
diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 8564a5c7d..315d96aef 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -116,7 +116,7 @@ flannel_version: 0.28.9
 flannel_cni_version: 1.7.1-flannel1
 cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"
 
-cilium_version: "1.20.1"
+cilium_version: "1.20.2"
 cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
 cilium_enable_hubble: false
 
@@ -239,13 +239,13 @@ cilium_operator_image_tag: "v{{ cilium_version }}"
 cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay"
 cilium_hubble_relay_image_tag: "v{{ cilium_version }}"
 cilium_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen"
-cilium_certgen_image_tag: "v0.4.9"
+cilium_certgen_image_tag: "v0.4.11"
 cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui"
-cilium_hubble_ui_image_tag: "v0.13.5"
+cilium_hubble_ui_image_tag: "v0.13.6"
 cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
-cilium_hubble_ui_backend_image_tag: "v0.13.5"
+cilium_hubble_ui_backend_image_tag: "v0.13.6"
 cilium_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
-cilium_envoy_image_tag: "v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7"
+cilium_envoy_image_tag: "v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82"
 kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
 kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
 kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml
index 077251dbc..17b3f3928 100644
--- a/roles/kubespray_defaults/vars/main/checksums.yml
+++ b/roles/kubespray_defaults/vars/main/checksums.yml
@@ -615,6 +615,7 @@ calicoctl_binary_checksums:
     3.29.0: sha256:c9c2a29a349c6f681aa79b5f5d6aee738305d95aa7f158b6217f487808758e53
 ciliumcli_binary_checksums:
   arm64:
+    0.20.0: sha256:9a9281dc79bd10a61fa35078b8ab63eaf491ab2f47edc6b9a3541b2fe4ede3ff
     0.19.7: sha256:9482937f14061fb239f2dbb2f97f4103de1b101f5d5defbff319f294f9bd540f
     0.19.6: sha256:fe8140aaaa561b7d59d8c0e7eef169c298b2d558924934c95aab8bb81382296f
     0.19.5: sha256:5498defafc248160ca44a38be39f5ba090769ef112f9ec34a19e72dfa7e7eb25
@@ -659,6 +660,7 @@ ciliumcli_binary_checksums:
     0.16.1: sha256:07f3f2ba4d772140e46004ee7fa239134acc27afc4f79fc301ee7037617babc1
     0.16.0: sha256:fe16bcd447fc6fe764ca75712f5832d7504845e9f782684ff09c9f52548237fe
   amd64:
+    0.20.0: sha256:94adc5c3be44d8240df91cec520536686f8a1eb29e5bc70c4c1c80137f00d764
     0.19.7: sha256:cd15e0983bf0acc7946cd05d453d1e58376ea92dec2642e745212df2b07d8852
     0.19.6: sha256:65ae7592ab873acc0b242b8e679e0a0a856255e34fdd0082e7b048b6285a9842
     0.19.5: sha256:67e59489b7ad17dea8eb8cc930435105dff3a4575643ad62567fb2c5ae80d246