upgrade Cilium v1.18.8 to v1.18.9 to fix S360 grpc vulnerability (google.golang.org/grpc v1.74.2 -> v1.79.3)

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>

Author: Rui Gao

contrib/aks/k8s-deploy/cilium.yaml

@@ -903,7 +903,7 @@ spec:
           type: Unconfined
       containers:
       - name: cilium-agent
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         command:
         - cilium-agent
@@ -1067,7 +1067,7 @@ spec:
 
       initContainers:
       - name: config
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         command:
         - cilium-dbg
@@ -1090,7 +1090,7 @@ spec:
       # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
       # We use nsenter command with host's cgroup and mount namespaces enabled.
       - name: mount-cgroup
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         env:
         - name: CGROUP_ROOT
@@ -1127,7 +1127,7 @@ spec:
             #drop:
             #  - ALL
       - name: apply-sysctl-overwrites
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         env:
         - name: BIN_PATH
@@ -1165,7 +1165,7 @@ spec:
       # from a privileged container because the mount propagation bidirectional
       # only works from privileged containers.
       - name: mount-bpf-fs
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         args:
         - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
@@ -1181,7 +1181,7 @@ spec:
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         command:
         - /init-container.sh
@@ -1228,7 +1228,7 @@ spec:
           mountPath: /var/run/cilium # wait-for-kube-proxy
       # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent
       - name: install-cni-binaries
-        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium:v1.18.9-update"
         imagePullPolicy: Always
         command:
           - "/install-plugin.sh"
@@ -1412,7 +1412,7 @@ spec:
           type: Unconfined
       containers:
       - name: cilium-envoy
-        image: "luciaopenpai.azurecr.io/cilium/cilium-envoy:v1.35.9-1773656288-update"
+        image: "luciaopenpai.azurecr.io/cilium/cilium-envoy:v1.36.6-1776000132-update"
         imagePullPolicy: Always
         command:
         - /usr/bin/cilium-envoy-starter
@@ -1590,7 +1590,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: cilium-operator
-        image: "luciaopenpai.azurecr.io/cilium/operator-generic:v1.18.8-update"
+        image: "luciaopenpai.azurecr.io/cilium/operator-generic:v1.18.9-update"
         imagePullPolicy: Always
         command:
         - cilium-operator-generic

src/cilium/build/cilium-agent.common.dockerfile

@@ -24,11 +24,11 @@
 #
 
 ARG GOLANG_VERSION=1.25.9
-ARG CILIUM_VERSION=v1.18.8
+ARG CILIUM_VERSION=v1.18.9
 ARG CNI_PLUGINS_VERSION=v1.9.0
 ARG GOPS_VERSION=v0.3.27
-ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:8f79229999eadc0ced8eacdfdd3574759246d025@sha256:4b36fa5fdeff01bcb7b5dacc9689539ec7f7cdf4a4b758933b0c5b5523a1069a
-ARG CILIUM_ENVOY_IMAGE=quay.io/cilium/cilium-envoy:v1.35.9-1773656288-7b052e66eb2cfc5ac130ce0a5be66202a10d83be@sha256:60031f39669542b21aedf05a3317d14e8d3ea48255790af039b315a1c9637361
+ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:13e905399a00ec93849808d5dc775ccc4a6a91a6@sha256:86dfbe17994adef8e7817b8d97351fd0120576a5fc845198f7d39a2788b891e9
+ARG CILIUM_ENVOY_IMAGE=quay.io/cilium/cilium-envoy:v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa@sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d
 
 # Stage 1: Build all Go binaries from source with Go 1.25.9
 FROM golang:${GOLANG_VERSION} AS builder

src/cilium/build/cilium-envoy.common.dockerfile

@@ -16,12 +16,12 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 # Rebuild cilium-envoy image with latest OS security patches.
-# Base: official cilium-envoy matching cilium v1.18.8
+# Base: official cilium-envoy matching cilium v1.18.9
 # This patches OS-level CVEs (libc6, libgnutls30t64, libsystemd0).
 #
 
-ARG CILIUM_ENVOY_TAG=v1.35.9-1773656288-7b052e66eb2cfc5ac130ce0a5be66202a10d83be
-FROM quay.io/cilium/cilium-envoy:${CILIUM_ENVOY_TAG}@sha256:60031f39669542b21aedf05a3317d14e8d3ea48255790af039b315a1c9637361
+ARG CILIUM_ENVOY_TAG=v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa
+FROM quay.io/cilium/cilium-envoy:${CILIUM_ENVOY_TAG}@sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d
 
 # Apply latest Ubuntu security updates
 RUN apt-get update && \

src/cilium/build/cilium-operator.common.dockerfile

@@ -21,7 +21,7 @@
 #
 
 ARG GOLANG_VERSION=1.25.9
-ARG CILIUM_VERSION=v1.18.8
+ARG CILIUM_VERSION=v1.18.9
 
 # Stage 1: Build operator binary
 FROM golang:${GOLANG_VERSION} AS builder