cilium-cli

No entries match these filters. Clear filters

1. v0.20.2 Oct 29, 2026 · issue 125

   cilium-cli adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. fallback for SPDYSPDYA deprecated Google-developed network protocol designed to speed up HTTP by multiplexing streams, compressing headers, and prioritizing requests over a single TCP connection; it became the basis for HTTP/2.-rejecting proxies and applies labels to all new test namespaces⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONHomebrewgit

   Homebrew copy

   $ brew install cilium-cli
   # already installed? upgrade to this version:
   $ brew upgrade cilium-cli

   git copy

   $ git clone --branch v0.20.2 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.20.2

   Homebrew lists this version · checked 30 Oct

   • cilium-cli now falls back to WebSocket when a proxy rejects the SPDY upgrade, so connectivity tests work through proxies that block SPDY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • cilium-cli now applies labels to all new test namespaces, making it easier to identify and filter test resources.
   • cilium-cli now falls back to WebSocket when a proxy rejects the SPDY upgrade, so connectivity tests work through proxies that block SPDY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The deprecated v2alpha1 version of the BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. is removed; clusters using v2alpha1 BGP CRDs must migrate before upgrading.
2. v0.20.0 Aug 28, 2026 · issue 058

   cilium-cli v0.20.0 adds reservedRanges for multi-pool IPAM and HTTP CONNECTHTTP CONNECTAn HTTP method that asks a proxy server to open a raw TCP tunnel to a target host, letting clients relay arbitrary traffic — including TLS — through the proxy without the proxy inspecting it. support in Envoy

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.20.0 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.20.0

   • Adds reservedRanges field to CiliumPodIPPools for multi-pool IPAM, enabling operators to exclude specific address ranges from pool allocation.
   • Adds HTTP CONNECT support to the Envoy integration, enabling tunneled proxy traffic through Cilium-managed Envoy.

   2 details in Everything

3. v0.19.6 Jul 14, 2026 · issue 015

   cilium-cli v0.19.6 adds table-json BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. output, hybrid routing mode support, Gateway API listenersets in sysdump, and TCPRoute/UDPRoute v1.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.19.6 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.19.6

   • Adds table-json output format to cilium-dbg bgp peers and cilium-dbg bgp routes for machine-readable BGP state.
   • Includes Gateway API listenersets in cilium sysdump captures.
   • Supports hybrid routing mode (routing-mode: hybrid), dynamically choosing native routing for same-subnet traffic and tunnel encapsulation for cross-subnet traffic.
   • Upgrades TCPRoute and UDPRoute Gateway API resources to v1.
   • Bumps minimum supported Cilium version to v1.16.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The minimum compatible Cilium version is now v1.16; clusters running Cilium v1.15 or older are no longer supported by this CLI version.
4. v0.19.5 Jun 25, 2026 · release notes

   cilium-cli v0.19.5 expands sysdump coverage with Gateway API and ClusterMesh resources

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.19.5 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.19.5

   • Adds CiliumGatewayClassConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. collection to sysdump for Gateway API troubleshooting
   • Adds Gateway API BackendTLSPolicy resource collection to sysdump
   • Captures additional operator and clustermesh-apiserver troubleshooting information in sysdump
   • Adds ClusterMesh endpoint slices watch and kvstoremesh wiring support

   4 details in Everything

5. v0.19.5 Jun 25, 2026 · issue 001

   cilium-cli v0.19.5 adds richer sysdump capture, ClusterMesh endpoint-slice wiring, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. library upgrade to GoBGP v4.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.19.5 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.19.5

   └──▷ TRY IT
   Capture enriched operator and clustermesh-apiserver data — useful when debugging cross-cluster or operator issues — alongside the standard sysdump bundle.
   copy

   $ cilium sysdump

   • Upgrades GoBGP from v3 to v4.5.0, enabling updated BGP protocol support in Cilium's BGP control plane.
   • Expands sysdump to capture additional operator and clustermesh-apiserver troubleshooting information.
   • Adds CiliumGatewayClassConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. collection to sysdump for Gateway API diagnostics.
   • Adds Gateway API BackendTLSPolicy resource collection to sysdump.
   • Enables ClusterMesh endpoint-slice watch and kvstoremesh wiring for improved multi-cluster networking.

   +2 more show less

   • Disables node-init on AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. by default, aligning installation behaviour with AKS BYOCNI requirements.
   • Replaces BoringCrypto with upstream Go crypto libraries, changing the cryptographic backend used in the CLI binary.

   7 details in Everything

6. v0.19.3 May 20, 2026 · release notes

   cilium-cli v0.19.3 adds log-scoped connectivity checks, cleanup flag, Cluster Mesh sysdump artifacts, and L2 Announcement Policy collection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.19.3 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.19.3

   └──▷ TRY IT
   Avoid false-positive log alerts from pre-test noise by scoping log checks to only the test window.
   copy

   $ cilium connectivity test --log-check-only-test-time=true

   Automatically clean up connectivity test artifacts after a run to keep the cluster tidy.
   copy

   $ cilium connectivity test --cleanup

   • Adds --log-check-only-test-time flag to connectivity tests to check only logs written after tests start, reducing false positives.
   • Adds --cleanup flag to remove connectivity test artifacts after a test run.
   • Adds --exit-zero-on-failure flag to connectivity tests to return exit code 0 even on test failure.
   • Sysdumps now additionally collect Cluster Mesh certificate generation artifacts.
   • Sysdumps now collect Cilium L2 Announcement Policies.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The enable-encryption-strict-mode, encryption-strict-mode-cidr, and encryption-strict-mode-allow-remote-node-identities options have been removed (previously deprecated).
   • !The v2alpha1 CiliumNodeConfig API has been removed; use the v2 API promoted in Cilium 1.16.
7. v0.19.1 Feb 17, 2026 · release notes

   cilium-cli v0.19.1 adds a restart flag to cilium upgrade and CA-bundle-based cluster mesh connections.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.19.1 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.19.1

   └──▷ TRY IT
   Restart Cilium components in-place during an upgrade, useful when rolling restarts are needed to pick up new config.
   copy

   $ cilium upgrade -r

   • Adds -r/-restart parameter to cilium upgrade for restarting components during upgrade.
   • Uses CA bundle to connect clusters in ClusterMesh, improving cross-cluster TLS trust handling.
   • Sysdump now uses label selectors for Hubble UI/Relay deployment collection, enabling more targeted diagnostics.

   3 details in Everything

8. v0.18.9 Dec 3, 2025 · release notes

   cilium-cli v0.18.9 adds TLS/mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for Operator Prometheus and CILIUM_NAMESPACE env var support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.18.9 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.18.9

   └──▷ TRY IT
   Avoid typing --namespace on every command when your Cilium install lives in a non-default namespace.
   copy

   $ export CILIUM_NAMESPACE=kube-system
   cilium status
   cilium connectivity test

   • Adds TLS/mTLS support for the Operator Prometheus endpoint using an existing Kubernetes secret.
   • Allows setting the default Cilium namespace via the CILIUM_NAMESPACE environment variable, replacing the need to pass --namespace on every command.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The CiliumBGPPeeringPolicy CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and its agent implementation have been removed. Migrate to the cilium.io/v2 CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.: CiliumBGPClusterConfig, CiliumBGPPeerConfig, CiliumBGPAdvertisement, and CiliumBGPNodeConfigOverride.
   • !Cilium v1.15 is now the minimum required version; clusters running older Cilium releases are no longer supported.
9. v0.18.8 Oct 22, 2025 · release notes

   ClusterMesh gains per-cluster endpoint and service metrics; sysdump now captures node/pod resource usage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.18.8 https://github.com/cilium/cilium-cli.git
   # already have the repo? check out this version:
   $ git checkout v0.18.8

   • Adds per-cluster metrics for ClusterMesh endpoints, global services, and MCS ServiceExport — replacing the previous single global count.
   • Adds node and pod resource usage collection to sysdump output.

   2 details in Everything

10. v0.18.7 Sep 3, 2025 · release notes

    cilium-cli v0.18.7 expands clustermesh CLI with multi-IP support, dict Helm values, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peer data in sysdumps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.7 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.7

    • Supports more than one service IP when connecting to remote clustermesh-apiserver (excluding NodePort Services).
    • Adds dict format support for Helm value clustermesh.config.clusters when connecting clusters.
    • Outputs clustermesh.config.clusters in the new dict format automatically for clusters running Cilium >= 1.20.
    • Includes BGP remote peer capabilities in sysdump output.

    4 details in Everything

11. v0.18.6 Jul 30, 2025 · release notes

    cilium-cli v0.18.6 adds node annotation cleanup on uninstall and partial BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peer output on errors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.6 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.6

    • Adds automatic removal of annotations from Kubernetes nodes during cilium uninstall when clean-cilium-state: true is set.
    • Prints partial output when cilium bgp peers encounters errors, rather than silently failing.

    2 details in Everything

12. v0.18.5 Jul 2, 2025 · release notes

    cilium-cli v0.18.5 adds clustermesh policy inspection, tolerations flag for connectivity tests, and improved EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. name detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.5 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.5

    └──▷ TRY IT
    Inspect the default local cluster policy in a ClusterMesh setup to audit which cluster is treated as local by default.
    copy

    $ cilium clustermesh inspect-policy-default-local-cluster

    Run connectivity tests on nodes with custom taints by specifying tolerations so test pods are schedulable everywhere.
    copy

    $ cilium connectivity test --tolerations '[{"key":"dedicated","operator":"Equal","value":"infra","effect":"NoSchedule"}]'

    • Adds clustermesh inspect-policy-default-local-cluster command to inspect default local cluster policy settings.
    • Adds support for policy-default-local-cluster option in connectivity tests.
    • Enables the --tolerations flag for all connectivity tests, not just a subset.
    • Adds OpenShift cluster Kind recognition to the CLI.
    • Includes detailed failure messages in the connectivity test JUnit report.

    5 details in Everything

13. v0.18.4 Jun 3, 2025 · release notes

    cilium-cli v0.18.4 adds VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments.-over-IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. tunnel underlay, IPv6 egress gateway policies, and promotes CiliumLoadBalancerIPPool to v2 API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.4 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.4

    • Adds VXLAN-in-IPsec (VinE) support, enabling encrypted VXLAN tunnels via IPsec.
    • Supports IPv6 as a tunneling underlay for overlay networking.
    • Adds support for IPv6 egress gateway policies.
    • Promotes CiliumLoadBalancerIPPool CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to v2 API version.
    • Adds TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. ServerNames validation in policy configuration.

    +5 more show less

    • New clusters created in ENI mode no longer masquerade pod traffic to the external world.
    • Removes tunnel map references from cilium-dbg, cilium status, and bugtool now that pod CIDRs are stored in the ipcache map.
    • Allows BINDIR environment variable to be dynamically configured for the CLI install path.
    • Migrates from corev1.Endpoints to discoveryv1.EndpointSlice internally.
    • Drops support for Cilium versions older than v1.14.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Cilium v1.14 is now the minimum required version; clusters running older Cilium releases will not be supported.
14. v0.18.3 Apr 3, 2025 · release notes

    cilium-cli v0.18.3 adds kernel profiling during perf tests, standalone perf testing, and IPSec key rotation validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.3 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.3

    • Adds support to capture kernel profiles during performance testing.
    • Enables performance tests to run independently of Cilium, removing the Cilium dependency.
    • Rejects IPSec key rotation attempts when key lengths mismatch, preventing IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. disruptions.
    • Cilium CLI releases are now available as Docker images on quay.io/repository/cilium/cilium-cli.

    4 details in Everything

15. v0.18.2 Mar 7, 2025 · release notes

    cilium-cli v0.18.2 adds egress gateway perf testing, cross-namespace sysdump selectors, and new image/log-owner filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.2

    └──▷ TRY IT
    Capture a sysdump with a label selector applied across all namespaces rather than a single namespace.
    copy

    $ cilium sysdump --extra-label-selectors app=my-app

    • Extends cilium connectivity perf to support egress gateway performance testing.
    • Relaxes --extra-label-selectors in cilium sysdump to target all namespaces, not just a single one.
    • Adds a parameter to print the container images used by Cilium components.
    • Supports filtering by --log-code-owners in CLI log output.

    4 details in Everything

16. v0.18.1 Mar 6, 2025 · release notes

    cilium-cli v0.18.1 adds a kubeconfig option to the GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.1 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.1

    • Adds --kubeconfig option to the gh command, enabling users to specify a custom kubeconfig path.

    1 detail in Everything

17. v0.16.24 Jan 29, 2025 · release notes

    cilium-cli v0.16.24 adds Tetragon sysdump capture, IP-family-scoped connectivity tests, and Helm max-history flag support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.24 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.24

    └──▷ TRY IT
    Capture Tetragon data alongside standard Cilium state when troubleshooting policy or observability issues.
    copy

    $ cilium sysdump

    Cap Helm release history to avoid unbounded revision growth during repeated cilium upgrades.
    copy

    $ cilium upgrade --max-history 5

    • Adds Tetragon Helm data collection to cilium sysdump output.
    • Collects Cilium Agent logs from crashing, not-ready, and restarted pods during sysdump.
    • Adds --max-history flag to Helm-based CLI commands.
    • Adds --ip-family restriction for connectivity tests to scope tests to specific IP families.
    • Significantly reduces memory usage during cilium sysdump collection, enabling sysdumps on larger clusters.

    5 details in Everything

18. v0.16.22 Dec 11, 2024 · release notes

    cilium upgrade now supports --reset-then-reuse-values flag to control Helm value merging behavior

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.22 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.22

    └──▷ USE IT
    Explicitly retain existing Helm values during an upgrade without the new default reset behavior
    shell copy

    cilium upgrade --reset-then-reuse-values=false

    Force a complete Helm value reset during an upgrade to ensure a clean slate
    shell copy

    cilium upgrade --reset-values

    └──▷ BREAKING ON UPGRADE

    • !The default behavior for cilium upgrade has changed such that Helm values will be reset and then reused; previous behavior can only be restored by setting --reset-then-reuse-values=false or explicitly using --reuse-values/--reset-values.
19. v0.16.21 Dec 6, 2024 · release notes

    cilium-cli v0.16.21 adds kubectl impersonation flags, AWS AL2023 support, and a new ipcache lookup by label/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.21 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.21

    • Adds --as and --as-group flags for kubectl-style impersonation across cilium-cli commands.
    • Adds AWS AL2023 platform support for cilium-cli installs.
    • New CLI option to display ipcache information filtered by labels or CIDR.
    • Default Cilium version to install is now derived from cilium/charts source instead of being injected at compile time via -ldflags.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for running the Cilium KVStore in pod network is disabled; setups relying on this deprecated mode will break.
20. v0.16.20 Nov 6, 2024 · release notes

    cilium-cli v0.16.20 adds --kubeconfig flag, native Hubble port-forwarding, parallel clustermesh connections, and multicast connectivity tests.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.20 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.20

    └──▷ TRY IT
    Target a specific kubeconfig when managing a cluster, useful when working with multiple clusters outside of the default context.
    copy

    $ cilium status --kubeconfig /path/to/kubeconfig

    • Adds --kubeconfig flag to explicitly specify a kubeconfig file for all CLI commands.
    • Replaces kubectl-based Hubble port-forwarding with a native implementation built into the Cilium CLI.
    • Deploys clustermesh connections in parallel, speeding up multi-cluster setup.
    • Adds multicast connectivity test to the connectivity test suite.
    • Adds config.cilium.io annotation display to cilium-cli status configmap output.

    +3 more show less

    • Increases hubble-event-queue-size for multicluster deployments.
    • Expands sysdump collection with miscellaneous improvements.
    • cilium-cli status now fails fast on terminal errors instead of waiting.

    8 details in Everything

21. v0.16.19 Oct 2, 2024 · release notes

    cilium-cli v0.16.19 improves clustermesh multi-context connections and adds BGPv2 CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. collection to sysdump

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.19 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.19

    • Improves --destination-context option for clustermesh connect to support connecting multiple remote contexts in one operation.
    • Collects BGPv2 CRD resources automatically during sysdump captures.
    • Skips Kubernetes client creation when --client is specified in the version command, enabling faster offline version checks.

    3 details in Everything

22. v0.16.16 Aug 20, 2024 · release notes

    cilium-cli v0.16.16 adds a test namespace parameter for connectivity tests and concurrent test run support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.16 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.16

    • Adds a --test-namespace parameter to connectivity tests, enabling control over which namespace tests run in.
    • Supports concurrent connectivity test execution via hooks, enabling parallel test workflows.

    2 details in Everything

23. v0.16.14 Jul 31, 2024 · release notes

    cilium-cli v0.16.14 adds a multicast subcommand, new L7/LRP connectivity tests, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. timer assertions, and a single JUnit report output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.14 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.14

    └──▷ TRY IT
    Inspect or manage multicast groups on a Cilium-managed cluster using the new subcommand.
    copy

    $ cilium multicast

    • Adds multicast subcommand for managing multicast networking.
    • New echo-ingress-l7-via-hostport-with-encryption connectivity test case (requires Cilium ≥ 1.16.0).
    • New local-redirect-policy-with-node-dns connectivity test case.
    • Connectivity tests now assert BGP timer intervals in BGP connectivity tests.
    • Sysdump now gathers gops data from the cilium-operator.

    +1 more show less

    • Connectivity test runs now produce a single consolidated JUnit report.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --test-namespace flag now always appends a concurrent group number suffix: the default test namespace is cilium-test-1 instead of cilium-test, even when --test-concurrency is set to 1.
24. v0.16.13 Jul 11, 2024 · release notes

    Adds port range connectivity tests and --disable-check flag to upgrade

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.13 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.13

    └──▷ USE IT
    Skip pre-flight checks when upgrading Cilium to speed up the process or bypass known issues.
    shell copy

    cilium upgrade --version v1.14.0 --disable-check

    Run connectivity tests checking a range of ports instead of single isolated ones.
    shell copy

    cilium connectivity test --test-port-range 8000-8100

    • Adds --disable-check flag to the cilium upgrade command to skip pre-flight health checks during upgrades.
    • Adds support for port range tests in connectivity testing to validate traffic across multiple ports simultaneously.

    2 details in Everything

25. v0.16.12 Jul 10, 2024 · release notes

    Adds --disable-check flag to bypass validation and supports BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. CP connectivity testing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.12 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.12

    • action: Use github.action_path when accessing cilium.sh
    • BGP CP connectivity tests

    2 details in Everything

26. v0.16.11 Jun 27, 2024 · release notes

    Adds --container option to cluster deployment actions and new pod-to-pod-no-frag connectivity check

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.11 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.11

    └──▷ USE IT
    Deploy Cilium in a GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. cluster using the CLI from inside a container to avoid host dependency conflicts
    shell copy

    cilium cluster deploy --container --cluster gke-cluster

    Run the new connectivity test to specifically validate MTU settings between pods
    shell copy

    cilium connectivity test --test pod-to-pod-no-frag

    • Adds a new --container flag to cilium cluster deploy (and related cluster management commands) to run cilium-cli inside a container instead of natively on the host, simplifying dependency management for GKE, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., and external workloads deployments
    • Adds a new connectivity test pod-to-pod-no-frag that checks for MTU misconfigurations by sending non-fragmented packets between pods

    2 details in Everything

27. v0.16.10 Jun 7, 2024 · release notes

    cilium-cli v0.16.10 adds egress-gateway-with-l7-policy and local redirect policy connectivity tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.10 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.10

    • Adds egress-gateway-with-l7-policy test case for validating Layer 7 policies with egress gateways in connectivity testing

    1 detail in Everything

28. v0.16.8 May 29, 2024 · release notes

    Adds concurrent connectivity tests and expanded ClusterMesh sysdump data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.8 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.8

    • Expands sysdump output to include additional ClusterMesh troubleshooting information and KVStoreMesh status
    • Improves ClusterMesh status reporting by displaying KVStoreMesh information directly in the CLI output

    2 details in Everything

29. v0.16.7 May 6, 2024 · release notes

    cilium-cli v0.16.7 improves coverage for Ingress service connectivity checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.7 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.7

30. v0.16.5 Apr 26, 2024 · release notes

    cilium-cli v0.16.5 adds host firewall tests to connectivity suite and enriches encryption status output with IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. details

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.5 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.5

    └──▷ USE IT
    Run the connectivity test suite including new host firewall checks to validate endpoint-to-host policy enforcement.
    shell copy

    cilium connectivity test --check-host

    • connectivity test now includes host firewall tests to verify endpoint-to-host connectivity policies.
    • encryption status output is enriched with IPsec details, providing deeper visibility into IPSec tunnel state.

    2 details in Everything

31. v0.16.4 Mar 28, 2024 · release notes

    cilium-cli v0.16.4 adds support for non-default Helm release names and fully-qualified DNS external targets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.4 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.4

    └──▷ USE IT
    When installing or managing Cilium via Helm but the release is named something other than cilium, use this flag to prevent lookup failures.
    shell copy

    cilium install --helm-release-name my-custom-cilium

    Use an FQDN as the external target for connectivity checks or load balancer configuration instead of a bare hostname.
    shell copy

    cilium connectivity check --external-target example.com.

    • Add --helm-release-name flag to enable Cilium CLI with a non-default Helm release name
    • Support fully-qualified domain names (FQDNs) as external targets

    2 details in Everything

32. v0.16.3 Mar 18, 2024 · release notes

    Add explicit affinity configuration for nodes without Cilium

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.3 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.3

33. v0.16.1 Mar 14, 2024 · release notes

    cilium-cli v0.16.1 adds the InitializeCommand hook and improves connectivity sysdump collection across clusters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.1 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.1

    • Adds InitializeCommand hook to cilium-cli's CLI plugin interface for custom initialization logic
    • Connectivity tests now collect sysdumps from all clusters in a multi-cluster setup when a failure occurs

    2 details in Everything

34. v0.16.0 Mar 5, 2024 · release notes

    cilium-cli v0.16.0 introduces host firewall connectivity tests and removes classic mode commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ USE IT
    Run a connectivity test that includes host-level firewall rules validation
    shell copy

    cilium connectivity test --test hostfw

    Ensure uninstall waits for all resources to be fully deleted before exiting
    shell copy

    cilium uninstall --wait

    • Introduce hostfw connectivity test type to verify network policies in the host namespace
    • GCP OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication replaces service account credentials for GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. clusters
    • Add --wait flag to uninstall command to use foreground deletion during cleanup

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The classic subcommands (including install, upgrade, clustermesh) are removed; users must migrate to the standard commands
    • !The --cluster-name flag is removed from relevant commands
    • !The --delete-cilium-pod-on-nodes flag is removed from connectivity tests
35. v0.15.23 Feb 16, 2024 · release notes

    cilli v0.15.23 adds IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. key management commands and AWS OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.23 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.23

    • Adds cilium ipsec key rotate command for rotating IPsec keys with optional algorithm changes
    • Adds cilium ipsec key status command to display current IPsec key status
    • Enables AWS OIDC authentication instead of static access keys for cloud integrations

    3 details in Everything

36. v0.15.22 Feb 1, 2024 · release notes

    Adds encryption status subcommand to display encryption configuration and state.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.22 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.22

    └──▷ TRY IT
    Check if network policy encryption is enabled and configured correctly on the cluster.
    copy

    $ cilium encryption status

37. v0.15.21 Jan 31, 2024 · release notes

    cilium-cli v0.15.21 adds bgp routes CLI command to retrieve BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. routes from the cluster

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.21 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.21

    └──▷ TRY IT
    Retrieve the current BGP routing table from the cluster to verify peer connectivity and route advertisement.
    copy

    $ cilium bgp routes

    • Adds bgp routes subcommand for retrieving Border Gateway Protocol (BGP) routes

    1 detail in Everything

38. v0.15.20 Jan 10, 2024 · release notes

    cilium-cli v0.15.20 adds clustermesh status support for external kvstores and enables connectivity tests without a Cilium node.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.20 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.20

    • cilium clustermesh status now works correctly with external key-value stores (e.g., etcd) instead of only Kubernetes configmaps
    • Connectivity tests can now run on nodes that do not have Cilium installed, enabling mixed-cluster or partial-deployment testing scenarios

    2 details in Everything

39. v0.15.19 Dec 18, 2023 · release notes

    cilium v0.15.19 introduces cilium connectivity check with third client support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.19 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.19

40. v0.15.17 Dec 5, 2023 · release notes

    cilium-cli v0.15.17 adds a timeout flag for connectivity test suites.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.17 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.17

    └──▷ USE IT
    Run a connectivity test that fails fast after 5 minutes instead of hanging indefinitely.
    shell copy

    cilium connectivity test --timeout 5m

    • Introduces --timeout flag for the cilium connectivity test command to limit execution time.

    1 detail in Everything

41. v0.15.15 Nov 28, 2023 · release notes

    cilium-cli v0.15.15 adds max-connected-clusters support, latency measurement in connectivity tests, and --nodes-without-cilium with SPIRE

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.15 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.15

    • Connectivity tests output includes counters for test results via connectivity/check improvements
    • --nodes-without-cilium flag now works with SPIRE for node filtering

    2 details in Everything

42. v0.15.14 Nov 16, 2023 · release notes

    sysdump now collects serial trace data and SPIRE server entries; connectivity tests gain control plane node and ingress controller support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.14 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.14

    • sysdump tasks now support serial execution mode to enable sequential trace data collection workflows

    1 detail in Everything

43. v0.15.13 Nov 6, 2023 · release notes

    Adds WG encap detection for Kubernetes >= 1.15

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.13 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.13

    • Detects WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. encapsulation on Kubernetes clusters version 1.15 and above.

    1 detail in Everything

44. v0.15.12 Nov 2, 2023 · release notes

    cilium-cli v0.15.12 adds --set flag (replacing --helm-set), skips build in actions, and improves encryption tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.12 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.12

    • --set replaces --helm-set for passing Helm values to the CLI's helm operations.
    • action now supports skipping the CLI build step via a new configuration option.
    • check command now uses a more generic CurlCommandWithOutput internally, improving reliability of connectivity tests.
    • Encryption-related connectivity tests are now more reliable, reducing false negatives.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --helm-set flag is removed; use --set instead.
45. v0.15.11 Oct 16, 2023 · release notes

    cilium-cli v0.15.11 adds Gateway API detection to sysdump and picks up SPIRE status messages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.11 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.11

    • sysdump now detects if Gateway API support is enabled in the cluster

    1 detail in Everything

46. v0.15.9 Oct 4, 2023 · release notes

    cilium-cli v0.15.9 adds cluster-mesh service annotation support, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.-referencing connectivity tests, and expanded sysdump collection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.9 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.9

    • clustermesh now supports Kubernetes service annotations for mesh configuration
    • connectivity checks can now reference nodes by CIDR in test definitions
    • sysdump task collects Tetragon PodInfo custom resources
    • sysdump task caches Cilium pods and cilium-config ConfigMap data
    • sysdump defaults to specific selectors for log collection tasks

    5 details in Everything

47. v0.15.8 Sep 12, 2023 · release notes

    cilium-cli v0.15.8 adds Kubernetes, operator, and clustermesh metrics to sysdump for deeper troubleshooting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.8 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.8

    • cilium sysdump now scrapes Kubernetes API metrics during collection
    • cilium sysdump collects Cilium operator and CilmeshClusterService (clustermesh) metrics

    2 details in Everything

48. v0.15.7 Aug 31, 2023 · release notes

    cilium-cli v0.15.7 adds helm get values integration to sysdump for troubleshooting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.7 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.7

    • sysdump command now includes Helm release values via helm get values for easier debugging of Cilium deployments

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated kube-proxy-replacement CLI flag has been removed; use the standard replacement flags instead
49. v0.15.5 Aug 2, 2023 · release notes

    cilium-cli v0.15.5 improves clustermesh status and ping connectivity checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.5 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.5

    • Improves the clustermesh status command output with better status reporting.
    • Adds special inconclusive result treatment for the ping connectivity check.

    2 details in Everything

50. v0.15.2 Jul 12, 2023 · release notes

    Adds SetupAndValidate() hook and collects node init Pod logs in sysdump for Cilium CLI v0.15.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.2

    • Adds the SetupAndValidate() hook to the hooks interface, allowing pre-execution validation or setup logic before CLI commands run
    • Extends sysdump to collect node init Pod logs and DaemonSet manifests during troubleshooting

    2 details in Everything

51. v0.14.8 Jun 23, 2023 · release notes

    cilium-cli v0.14.8 adds --enable-kvstoremesh, a new Helm flag for Clustermesh installs and a disconnect command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.8 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.8

    • Adds --enable-kvstoremesh flag to clustermesh enable to control KVStoreMesh deployment.
    • Adds a new helm clustermesh disconnect subcommand to manage Clustermesh Helm releases.

    2 details in Everything

52. v0.14.7 Jun 14, 2023 · release notes

    cilium-cli v0.14.7 adds custom test annotations, node affinity for Operator install, and clustermesh connect support in Helm mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.7 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.7

    └──▷ USE IT
    Deploy the Cilium Operator onto specific nodes using node affinity in Helm mode.
    shell copy

    cilium install --helm --set operator.nodeAffinity.key=node-role.io/infra --set operator.nodeAffinity.operator=In --set operator.nodeAffinity.values=[true]

    Add custom labels/annotations to connectivity check test pods for debugging or filtering.
    shell copy

    cilium connectivity check --annotation app=test-traffic --annotation owner=devops

    • install command now supports passing node affinity configuration to the Cilium Operator via the operator.nodeAffinity Helm value.
    • connectivity check allows adding custom annotations to the test deployment pods for targeted testing scenarios.
    • status command now prints the Helm chart version when running in Helm mode, aiding in deployment verification.

    3 details in Everything

53. v0.14.4 May 25, 2023 · release notes

    cilium-cli v0.14.4 adds CiliumCIDRGroup CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. support, dedicated Envoy DaemonSet for connectivity tests, and GatewayAPI to sysdump.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.4 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.4

    • Add support for CiliumCIDRGroup CRD in helm mode
    • Add GatewayAPI resources to sysdump collection

    2 details in Everything

54. v0.14.3 May 17, 2023 · release notes

    cilium-cli v0.14.3 adds JUnit output for connectivity tests and fixes clustermesh connect in Helm mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.3 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.3

    └──▷ TRY IT
    Generate machine-readable JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. results from a connectivity test run for CI/CD reporting.
    copy

    $ cilium connectivity test --junit-out /path/to/results.xml

55. v0.14.2 May 8, 2023 · release notes

    cilium-cli v0.14.2 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. repository support and an upgrade command with documentation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.2

    • Handle OCI repositories

    1 detail in Everything

56. v0.14.1 May 3, 2023 · release notes

    Adds clustermesh enable/disable and workflow support in helm mode; makes Helm chart repo configurable

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.1 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.1

    • Adds cilium helm clustermesh enable and cilium helm clustermesh disable subcommands to manage clustermesh configuration during installation
    • Adds --repository flag to helm commands to allow configuring the Helm chart repository URL for Cilium
    • Allows setting a custom timeout duration via --timeout flag on cilium uninstall operations

    3 details in Everything

57. v0.14.0 Apr 24, 2023 · release notes

    cilium-cli v0.14.0 adds experimental helm installation mode with new subcommands and flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    └──▷ USE IT
    Install Cilium using the new Helm mode instead of the standard manifests, allowing interchangeability with helm commands.
    shell copy

    cilium install --helm

    Validate a Helm-based installation plan without applying changes, dumping the generated values for inspection.
    shell copy

    cilium install --helm --dry-run --dry-run-helm-values

    Pass custom Helm values using the new --helm-set flag, replacing deprecated mechanisms.
    shell copy

    cilium install --helm --helm-set cilium.k8sSecurityPolicy.enabled=true

    Manage the Hubble relay component via the specific Helm mode commands.
    shell copy

    cilium hubble enable
    -- Or to disable it later:
    cilium hubble disable

    • Adds cilium install --helm to enable the new Helm-based installation mode
    • Adds --nodes-without-cilium flag to the Helm install mode for specifying nodes excluded from Cilium deployment
    • Adds --dry-run and --dry-run-helm-values flags to install in Helm mode for pre-flight validation
    • Adds --helm-set as the replacement for previously deprecated flags when passing Helm values
    • Adds cilium uninstall --helm command to manage Helm-based installations

    +2 more show less

    • Adds cilium hubble enable and cilium hubble disable commands within Helm mode for Hubble lifecycle management
    • Implements cilium upgrade using Helm to update existing Cilium installations managed via the Helm toolchain

    7 details in Everything

58. advisory CVE-2023-28114 Mar 21, 2023 · issue 128
    • CVE-2023-28114: cilium-cli disables etcd authorization for clustermesh clusters (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects < 0.13.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
59. v0.13.2 Mar 21, 2023 · release notes

    cilium-cli v0.13.2 adds nodeSelector for connectivity test pods and cni.uninstall flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.13.2

    └──▷ USE IT
    Run connectivity checks only on worker nodes labeled role=worker to avoid interfering with control plane tests.
    shell copy

    cilium connectivity check --node-selector role=worker

    • Adds --node-selector flag to the connectivity check command to restrict which nodes are used for connectivity test pods
    • Adds cni.uninstall configuration key to the install/uninstall workflow to force CNI uninstallation

    2 details in Everything

60. v0.13.0 Feb 24, 2023 · release notes

    cilium-cli v0.13.0 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. connectivity test support and sysdump HTML output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    • Adds IPv6 support in ICMP-related network policies for connectivity tests to enable testing dual-stack clusters
    • Introduces an HTML table view for events in the sysdump command, making event data filterable and easier to review

    2 details in Everything

61. v0.12.13 Feb 15, 2023 · release notes

    cilium-cli v0.12.13 adds JSON output for status and auto-enables BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. masquerade by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.13 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.13

    └──▷ TRY IT
    Parse cilium status programmatically in scripts or CI pipelines.
    copy

    $ cilium status -o json | jq .ClusterId

    • status command outputs JSON when the -o json flag is provided

    1 detail in Everything

62. v0.12.12 Jan 11, 2023 · release notes

    cilium-cli v0.12.12 adds encryption connectivity tests, --open-browser for Hubble UI, and max timeout support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.12 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.12

    └──▷ USE IT
    Run connectivity tests with specific timeouts for unstable networks.
    shell copy

    cilium connectivity test --max-connect-timeout 30s --max-recv-timeout 60s

    Start the Hubble UI and immediately open it in your default browser.
    shell copy

    cilium hubble ui --open-browser

    • Adds --max-connect-timeout and --max-recv-timeout flags to cilium connectivity test for controlling request timeouts.
    • Adds --open-browser flag to cilium hubble ui to automatically launch the default browser after starting the UI server.
    • Adds encryption connectivity test support (L7 ingress, node-to-node) in cilium connectivity test.

    3 details in Everything

63. v0.12.11 Dec 1, 2022 · release notes

    cilium-cli v0.12.11 updates cluster mesh logic and pod status counting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.11 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.11

    • clustermesh: use Cilium version extracted from helm secret if available
    • status: Include pending pods in total Cluster Pods count

    2 details in Everything

64. v0.12.9 Nov 23, 2022 · release notes

    Adds --collect-sysdump-on-failure flag to connectivity tests and EgressGatewayPolicy collection in sysdump

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.9 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.9

    └──▷ USE IT
    Run connectivity tests and automatically capture diagnostic data on failure for faster debugging.
    shell copy

    cilium connectivity test --collect-sysdump-on-failure

65. v0.12.8 Nov 21, 2022 · release notes

    cilium-cli v0.12.8 adds install manifest support for multiple roles/rolebindings per file

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.8 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.8

    • cilium install now accepts manifests with multiple Role and ClusterRole resources in a single file

    1 detail in Everything

66. v0.12.7 Nov 14, 2022 · release notes

    cilium-cli v0.12.7 adds arm64 network-perf support and kube-proxy replacement improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.7 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.7

    • Enable network-perf for arm64 architectures
    • Improve kube-proxy detection and replacement logic
    • Improve k8s API server endpoint detection to handle Kind clusters

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the kube-proxy-replacement=probe option
    • !Renamed the clustermesh host-reachable-svc option
67. v0.12.6 Nov 3, 2022 · release notes

    cilium-cli v0.12.6 adds Helm .Capabilities.APIVersions configuration during install

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.6 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.6

    • install: Add ability to auto-fill or manually set .Capabilities.APIVersions in helm

    1 detail in Everything

68. v0.12.5 Oct 18, 2022 · release notes

    cilium-cli v0.12.5 adds drop direction/reason to policy and configurable agent pod selector

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.5 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.5

    └──▷ HOW TO FIND IT
    Log exactly why Cilium dropped a specific packet using the new policy fields.
    📍kubectl apply -f - <<EOF apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: drop-egress spec: endpointSelector: matchLabels: app: myapp egress: - toEndpoints: - matchLabels: k8s:io.kubernetes.pod.namespace: default toPorts: - ports: - port: 443 protocol: TCP drop: direction: out reason: Deny by policy EOF
    • policy manifests now support drop direction and reason fields for precise network traffic rejection logging.

    1 detail in Everything

69. v0.12.4 Sep 21, 2022 · release notes

    cilium-cli v0.12.4 adds L7 HTTP method test support and remote chart version configuration in helm mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.4 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.4

    • Adds new Helm config option remoteChartVersion to specify a remote chart version for deployment.
    • Expands FQDN connectivity tests to assert policy denies for disallowed FQDNs.
    • Adds L7 HTTP method test capability for layer 7 protocol validation.

    3 details in Everything

70. v0.12.2 Aug 26, 2022 · release notes

    cilium install auto-detects missing kube-proxy to enable replacement

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.2

    • cilium install now automatically enables kube-proxy replacement when no existing kube-proxy is detected in the cluster

    1 detail in Everything

71. v0.12.1 Aug 4, 2022 · release notes

    cilium-cli v0.12.1 adds --assume-cilium-version flag and kvstore data to sysdump

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.1 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.1

    └──▷ USE IT
    Run connectivity checks in environments where version detection is slow or unreliable, bypassing it entirely.
    shell copy

    cilium connectivity check --assume-cilium-version 1.12.0

    Collect full cluster state including key-value store entries when troubleshooting connectivity issues.
    shell copy

    cilium sysdump > cilium-dump.tar.gz

    • Adds --assume-cilium-version flag to connectivity check to skip version detection when Cilium version is known in advance.
    • Includes kvstore data dumps in cilium sysdump output for easier debugging of cluster state.

    2 details in Everything

72. v0.12.0 Jul 19, 2022 · release notes

    cilium-cli v0.12.0 adds L7 policy testing and custom agent daemonset support in connectivity tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    └──▷ USE IT
    Validate L7 ingress policies by verifying HTTP headers are correctly enforced in connectivity tests.
    shell copy

    cilium connectivity test --test-pattern 'L7.*ingress'

    • [connectivity tests] test L7 ingress policy with HTTP headers

    1 detail in Everything

73. v0.11.8 Jun 14, 2022 · release notes

    cilium-cli v0.11.8 adds AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. BYOCNI support, --list-versions flag to install, and image argument to connectivity test.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.8 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.11.8

    └──▷ TRY IT
    Check available Cilium versions before installation without deploying anything.
    copy

    $ cilium install --list-versions

    • Add --list-versions flag to the install command
    • Support AKS BYOCNI in cluster creation
    • Add CLI argument for specifying image in connectivity test subcommand

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --base-version flag is removed from the install, connectivity, and hubble subcommands
74. v0.10.6 May 24, 2022 · release notes

    Adds install support for the new agent health check port to detect unhealthy Cilium agents.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.6 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.10.6

75. v0.11.6 May 13, 2022 · release notes

    cilium-cli v0.11.6 adds hubble relay upgrade via CLI and improved status performance

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.6 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.11.6

    └──▷ TRY IT
    Upgrade Hubble Relay to the version bundled with this cilium-cli release in one step.
    copy

    $ cilium hubble deploy --upgrade

    • Enables upgrading Hubble Relay directly through the cilium CLI without manual intervention.
    • Improves the performance of the cilium status command for faster cluster health checks.

    2 details in Everything

76. v0.11.5 May 5, 2022 · release notes

    cilium-cli v0.11.5 adds CNI config collection and ingress fixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.5 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.11.5

    • Adds support to collect CNI config files from the system
    • Includes couple of changes to support Ingress/CEC/CCWEC

    2 details in Everything

77. v0.11.4 Apr 29, 2022 · release notes

    cilium-cli v0.11.4 adds install encryption key generation and improved cluster diagnostics

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.4 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.11.4

    • Adds automatic PID detection for the gops agent in status output

    1 detail in Everything

78. v0.11.2 Apr 25, 2022 · release notes

    cilium-cli v0.11.2 adds --peer-service and CNI chaining to install

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.11.2

    └──▷ TRY IT
    Deploy cilium with Peer Service enabled for Hubble Relay integration.
    copy

    $ cilium install --peer-service

    Install cilium in an AWS environment using CNI chaining.
    copy

    $ cilium install --aws-cni-chaining

    • Adds install subcommand support for Peer Service enablement via the new --peer-service flag.
    • Adds install support for AWS environments with CNI chaining.
    • Makes context and namespace flags global across all cilium-cli commands.

    3 details in Everything

79. v0.11.0 Apr 13, 2022 · release notes

    cilium-cli v0.11.0 adds --cilium-operator-namespace to sysdump, new image-suffix/image-tag CLI flags for install, and standalone workload support in connectivity tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    └──▷ TRY IT
    Collect sysdump data from a non-default operator namespace.
    copy

    $ cilium sysdump --cilium-operator-namespace=kube-system

    Install Cilium using a specific image tag and suffix to match previous version conventions.
    copy

    $ cilium install --version 1.11.3 --image-tag latest --image-suffix -amd64

    Run a connectivity test using only standalone workloads, without deploying the full cluster infrastructure.
    copy

    $ cilium connectivity test --workload-only

    • Add --cilium-operator-namespace flag to the cilium sysdump command to specify a custom namespace for the Cilium operator.
    • Add image-suffix and image-tag flags to the cilium install command, allowing users to retain older image naming behavior while using the new default versioning scheme.
    • Introduce support for standalone workloads in cilium connectivity test, enabling network performance testing outside of full cluster deployments.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecation of old CLI flags in cilium install (specific flag names not listed in release notes, but old behavior is replaced by image-suffix/image-tag).
80. v0.10.1 Jan 21, 2022 · release notes

    cilium-cli v0.10.1 adds K3s support and improves sysdump and bugtool capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.1 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.10.1

    • Adds K3s as a supported environment for cluster installation
    • sysdump: Support fetching DaemonSet with custom name via new flag logic
    • bugtool: Enable compressed bundle copying with resume capability

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --native-routing-cidr flag is removed from install commands
81. v0.10.0 Dec 9, 2021 · release notes

    cilium-cli v0.10.0 adds configurable Hubble UI version and supports Envoy CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it./Ingress Controller.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    • hubble.enable now supports a ui_version config key to control the bundled Hubble UI version instead of using a fixed release
    • Adds support for Envoy Cluster, Listener, and IngressRoute CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. in Cilium network policy enforcement
    • Installs with BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. masquerading disabled by default, changing the source-NAT behavior for non-cluster traffic

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --native-routing-cidr flag is replaced by --ipv4-native-routing-cidr in install commands
    • !The deprecated cilium-ready-timeout flag on the hubble command is removed
82. v0.9.3 Nov 9, 2021 · release notes

    cilium-cli v0.9.3 adds hostname-based load balancing and fixes sysdump errors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.3 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.9.3

    • Adds support for resolving hostnames to IP addresses in load balancer configuration.
    • Ensures sysdump reports an error when the underlying collector initialization fails, preventing silent data loss.
    • Registers v2alpha1 types in the client scheme for extended API object handling.

    3 details in Everything

83. v0.9.2 Oct 25, 2021 · release notes

    cilium-cli v0.9.2 adds --rollback, --cilium-bugtool-flags, and Windows/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.2 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.9.2

    └──▷ USE IT
    Revert a failed or unwanted Cilium installation.
    shell copy

    cilium install --rollback

    Pass specific flags to the cilium-bugtool binary during diagnostics collection.
    shell copy

    cilium sysdump --cilium-bugtool-flags="--custom-flag=value"

    • Adds --rollback option to the install subcommand to undo a deployment.
    • Adds --cilium-bugtool-flags flag to the sysdump command for passing flags to cilium-bugtool.

    2 details in Everything

84. v0.9.1 Sep 24, 2021 · release notes

    cilium-cli v0.9.1 adds --extra-label-selectors to log collector and expands sysdump coverage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.1 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.9.1

    └──▷ TRY IT
    Collect logs only from pods in the monitoring namespace using a label selector, reducing noise and storage.
    copy

    $ cilium logcollector --extra-label-selectors app=monitoring

    • Adds --extra-label-selectors flag to the cilium logcollector command to allow filtering collected logs by arbitrary Kubernetes label selectors.
    • Extends cilium sysdump to automatically collect CiliumEgressNATPolicy and CiliumLocalRedirectPolicy resources for better debugging of policy-related issues.

    2 details in Everything

85. v0.9.0 Sep 7, 2021 · release notes

    cilium-cli v0.9.0 adds --skip-ip-cache-check flag, Windows builds, hubble-ui status, and sysdump improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ USE IT
    Skip ipcache check during deployment to bypass validation issues in incompatible environments
    shell copy

    cilium install --skip-ip-cache-check

    • Adds --skip-ip-cache-check flag to disable ipcache validation during install/upgrade
    • Extends cilium status output with managed endpoint count and running Cilium version details
    • Enhances sysdump collection to include clustermesh-apiserver resources with improved data gathering
    • Enables Windows executable builds as part of the standard release artifacts

    4 details in Everything

86. v0.8.6 Aug 9, 2021 · release notes

    cilium-cli v0.8.6 adds hidden --base-version to install, sysdump hubble flow collection, and egress HTTP with toFQDNs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.6 https://github.com/cilium/cilium-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.8.6

    • Adds install command hidden flag --base-version to specify the base CLI version during installation
    • Enhances sysdump to collect Hubble network flows for debugging
    • Enhances sysdump to capture init container logs in addition to standard pod logs
    • Enables egress HTTP policy enforcement with FQDN resolution via the new toFQDNs selector

    4 details in Everything