deps: bump cilium to v1.20.0 and migrate relocated internal APIs

[Quang Nguyen (nddq)]

Description

Bumps github.com/cilium/cilium v1.19.4 → v1.20.0. The bump transitively pulls k8s.io/* 0.36.3, controller-runtime 0.24.1, cilium/ebpf 0.22.0, cilium/statedb 0.8.3, and cilium/hive v1.0.4.

Retina embeds part of Cilium's Hive graph to enrich Hubble flows. v1.20 replaced pkg/datapath/types with generated BPF bindings and moved the interfaces that Retina uses. The bump therefore needs these code changes:

• API moves:

  • datapath.NodeHandler → node.Handler
  • datapath.IptablesManager → iptables.Manager
  • datapath config interfaces → per-subsystem types.Config
  • pkg/datapath/fake/types → per-subsystem fake packages
  • daemonk8s table cells → pkg/k8s/tables

• New interface method: LocalNodeSynchronizer gains WaitForNodeInformation. Retina's implementation returns at once, because InitLocalNode seeds NODE_IP synchronously.

• Nil dereference fix: v1.19 ignored the *node.LocalNodeStore parameter of CiliumSlimEndpointResource. v1.20 reads it in a new pod indexer, so the nil that Retina passed panics the informer on the first CiliumEndpoint. Retina now passes the real store and also sets the Logger and MetricsProvider fields.

• Node handler registry: in v1.20, the Hubble peer service subscribes one handler per gRPC Notify stream. This makes two defects reachable:

  • Subscribe wrote to the handlers map under a read lock. Two concurrent streams corrupt the map and crash the agent.
  • The map key was Name(). Every peer handler is named "hubble-peer", so a second stream evicts the first.

  The registry now keys handlers by identity under an exclusive lock. Upstream does the same.

• Operator cleanup: v1.20's metrics and endpoint-GC cells own their configuration through cell.Config, and operator/option stopped exporting the leader-election flag names. This PR:

  • removes the *operatorOption.OperatorConfig provider and the SharedConfig plumbing that read it
  • declares the three leader-election flags locally, with the same names and defaults
  • binds job.Registry to the leader lifecycle and invokes registerOperatorHooks last — both match upstream v1.20

• Stub cleanup: v1.20 rewrote the watcher constructors to depend on narrow types instead of the agentK8s.Resources bundle. That rewrite made 12 of Retina's 20 stub providers and all of NoOpPolicyRepository unreachable. This PR removes them: net −84 lines in pkg/k8s.

• CRDs: regenerated with controller-gen v0.20.1. Only the controller-gen version annotation changes. The schemas are identical.

Related Issue

N/A.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

go test -tags=unit,dashboard -skip=TestE2E* ./...        # all packages ok
go build ./...                                           # linux + windows + strict -mod
CGO_ENABLED=1 go test -tags=unit -race -count=5 \
    -run TestSubscribeConcurrentSameNameHandlers ./pkg/controllers/daemon/nodereconciler

The new TestAgentHiveResolves and TestOperatorHiveResolves resolve the agent and operator hives at test time. If a future Cilium bump adds a required provider, these tests fail in CI before the change crash-loops on a cluster. Without the Subscribe fix, the race test fails with DATA RACE.

Deployed to a 2-node AKS cluster (Kubernetes 1.35.6):

• The agent, operator, and relay ran with zero restarts.
• Flows enriched with pod identity and L7 DNS.
• The eBPF plugins loaded under ebpf v0.22.0, and every metric family exported data.

The peer-stream tests targeted the handler-registry fixes:

• Two relay replicas held concurrent peer streams. Both replicas received both peers.
• After one relay died, the survivor served flows from both nodes.
• Three relay restart cycles plus one agent-pod kill produced zero restarts and zero concurrent map errors.

Upgrade path: installed the released retina-hubble v1.2.3 chart, which pins cilium v1.19.3, then ran helm upgrade to these images. The rollout was clean. The Cilium CRD specs hash identically before and after the upgrade, so v1.20 accepts CRDs that a v1.19 operator created. The TLS variant (hubble.tls.enabled=true) passed the same checks.

Additional Notes

N/A.

[github-actions]

Retina Code Coverage Report

Total coverage increased from 36.5% to 36.7% ✅

Increased diff

Impacted Files	Coverage
operator/cmd/cilium-crds/zap_linux.go	0.0% ... 100.0% (100.0%)	⬆️
cmd/hubble/daemon_main_linux.go	0.0% ... 3.7% (3.7%)	⬆️
operator/cmd/cilium-crds/lifecycle.go	33.3% ... 100.0% (66.7%)	⬆️
operator/cmd/cilium-crds/root_linux.go	0.0% ... 5.04% (5.04%)	⬆️
pkg/controllers/daemon/nodereconciler/node_controller_linux.go	0.0% ... 12.5% (12.5%)	⬆️

[Copilot]

Pull request overview

Updates Retina’s embedded Cilium Hive integrations to Cilium v1.20.0 while preserving Hubble enrichment and operator behavior.

Changes:

• Upgrades Cilium, Kubernetes, eBPF, Hive, StateDB, and related dependencies.
• Migrates relocated APIs and updates agent/operator dependency wiring.
• Fixes concurrent node-handler registration and adds Hive-resolution tests.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/k8s/placeholders_linux.go	Removes obsolete policy stubs.
pkg/k8s/local_node_synchronizer_linux.go	Implements the new synchronizer method.
pkg/k8s/cell_linux.go	Migrates Cilium watcher and datapath wiring.
pkg/controllers/daemon/nodereconciler/node_controller_linux.go	Makes handler registration identity-based and synchronized.
pkg/controllers/daemon/nodereconciler/node_controller_linux_test.go	Tests concurrent same-name handlers.
pkg/controllers/daemon/nodereconciler/cell_linux.go	Updates the handler map type.
operator/cmd/cilium-crds/root_linux.go	Localizes leader-election configuration.
operator/cmd/cilium-crds/lifecycle.go	Associates jobs with leader lifecycle.
operator/cmd/cilium-crds/hive_linux_test.go	Verifies operator Hive resolution.
operator/cmd/cilium-crds/flags.go	Migrates operator flags.
operator/cmd/cilium-crds/cells_linux.go	Updates operator cell wiring and ordering.
operator/cmd/cilium-crds/cells_linux_test.go	Updates authentication graph setup.
go.sum	Refreshes dependency checksums.
go.mod	Upgrades Cilium and transitive dependencies.
deploy/standard/manifests/controller/helm/retina/crds/retina.sh_tracesconfigurations.yaml	Updates generator annotation.
deploy/standard/manifests/controller/helm/retina/crds/retina.sh_retinaendpoints.yaml	Updates generator annotation.
deploy/standard/manifests/controller/helm/retina/crds/retina.sh_metricsconfigurations.yaml	Updates generator annotation.
deploy/standard/manifests/controller/helm/retina/crds/retina.sh_captures.yaml	Regenerates capture CRD metadata ordering.
cmd/hubble/cells_linux_test.go	Verifies agent Hive resolution.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.