v1.16.0-rc.1 release

[aanm]

Setup preparation

• [x] Depending on your OS, make sure Docker is running
• [x] Export a GITHUB_TOKEN that has access to the repository. Only classic tokens are supported at the moment, the needed scope is public_repo.
• [x] Make sure a setup (GPG, SSH, S/MIME) is in place for signing tags with Git and install gh.
• [ ] Make sure the GOPATH environment variable is set and pointing to the relevant path

• [ ] Make sure the Cilium helm charts and release repositories are installed locally:

  • [ ] Run git clone https://github.com/cilium/charts.git "$GOPATH/src/github.com/cilium/charts"
  • [ ] Run git clone https://github.com/cilium/release.git "$GOPATH/src/github.com/cilium/release"

  • [ ] If you already have the repo checked out, make sure the release binary is up to date:

    git checkout pr/fun-next-release && git pull && make

• [x] Read the documentation of release start --help tool to understand what each automated step does.

Pre-check (run ~1 week before release date)

• [x] When you create a GitHub issue using this issue template, GitHub Slack app posts a message in #launchpad Slack channel. Create a thread for that message and ping the current backporter to merge the outstanding backport PRs and stop merging any new backport PRs until the GitHub issue is closed (to avoid generating incomplete release notes).
• [x] Run ./release start --steps 1-pre-check --target-version v1.16.0-rc.1
  • [x] Check that there are no release blockers for the targeted release version.
  • [x] Ensure that outstanding backport PRs are merged (these may be skipped on case by case basis in coordination with the backporter).
  • [x] Check with @cilium/security team in case there are any CVEs found in the docker image.
  • [x] Check with @cilium/security team if there are any security fixes to include in the release.

Preparation PR (run ~1 day before release date. It can be re-run.)

~- [x] Go to release workflow and trigger the "2-prepare-release" step for v1.16.0-rc.1~ ~- [x] Check if the workflow was successful and check the PR opened by the Release bot.~

• [x] Run ./release start --steps 2-prepare-release --target-version v1.16.0-rc.1
• [x] Merge PR https://github.com/cilium/cilium/pull/33463

Tagging

• [x] Ask a maintainer if there are any known issues that should hold up the release
• [x] FYI, do not wait too much time between a tag is created and the helm charts are published. Once the tags are published the documentation will be pointing to them. Until we release the helm chart, users will face issues while trying out our documentation.
• [x] Run ./release start --steps 3-tag --target-version v1.16.0-rc.1
• [x] Ask a maintainer to approve the build in the following link (keep the URL of the GitHub run to be used later): Cilium Image Release builds

Post Tagging (run after docker images are published)

~- [ ] Go to release workflow and trigger the "4-post-release" step for v1.16.0-rc.1~ ~- [ ] Check if the workflow was successful and check the PR opened by the Release bot.~

• [x] Run ./release start --steps 4-post-release --target-version v1.16.0-rc.1
• [x] Merge PR https://github.com/cilium/cilium/pull/33464

Publish helm (run after docker images are published)

• [x] Update helm charts ./release start --steps 5-publish-helm --target-version v1.16.0-rc.1
• [x] Open Charts Workflow and check if the workflow run is successful.
• [x] Check draft release from releases page
  • [x] Update the text at the top with 2-3 highlights of the release
  • [x] Check with @cilium/security if the release addresses any open security advisory. If it does, include the list of security advisories at the top of the release notes.
  • [x] Check whether the new release should be set as the latest release (via the checkbox at the bottom of the page). It should be the new latest if the version number is strictly superior to the current latest release displayed on GitHub (e.g. 1.11.13 does not become the new latest release over 1.12.5, but version 1.12.6 will).
  • [x] Publish the release
• [x] Announce the release in #general on Slack (do not use [@]channel)

Post-release

• [x] Prepare post-release changes to main branch using ../release/internal/bump-readme.sh.

[joestringer]

We just branched v1.16. The precheck stage incorrectly asserts that PRs with release-blocker/1.16 that are merged are not part of the branch.

$ release start --steps 1-pre-check --target-version v1.16.0-rc.1                                
💡 The PREVIOUS released version was v1.16.0-rc.0, continue? (Y/N): y                                                                                            
🏃 Running group "1-pre-check"                                                                                                                                   
🏃 Running step "checking for release blockers"                                                                                                                  
  👀 Checking for opened GH issues and pull requests with the label "release-blocker/1.16" and for closed GH Pull Requests with that same label that are not back
ported yet but got merged in the 'main' branch after '2024-06-17':                                                                                               
   https://github.com/cilium/cilium/labels/release-blocker/1.16                                                                                                  
   https://github.com/cilium/cilium/issues?q=is%3Aopen+label:release-blocker/1.16+-is%3Adraft                                                                    
   https://github.com/cilium/cilium/issues?q=is:pull-request%20state:closed%20is:merged%20merged:%3E=2024-06-17%20base:main%20-label:backport-done%2F1.16%20label
:release-blocker%2F1.16%20repo:cilium%2Fcilium                                                                                                                   
    ⚠️ Found release blockers:
    https://github.com/cilium/cilium/issues/33257 - CI: Conformance E2E (ci-e2e) / outside-to-ingress-service
    https://github.com/cilium/cilium/issues/32943 - CI: NAT46x64 
    https://github.com/cilium/cilium/issues/32689 - CI: Cilium E2E Upgrade - no-errors-in-logs - retrieving device lxc_health: Link not found
    https://github.com/cilium/cilium/pull/33448 - policy: Fix parsing of CIDR labels
    https://github.com/cilium/cilium/pull/33447 - Fix container/bitlpm traversal 
    https://github.com/cilium/cilium/pull/33389 - docs: Add Port Range Information
    https://github.com/cilium/cilium/pull/33404 - cilium: add note into upgrade guide and perf guide about netkit enablement
    https://github.com/cilium/cilium/pull/33396 - fix edge case in cidrGroupRefs 
    https://github.com/cilium/cilium/pull/33394 - Revert "IPAM: Adds AWS IPv6 Prefix Delegation Config Option"
    https://github.com/cilium/cilium/pull/33392 - bgpv2: Fix defaulting of BGP peer config                          
    https://github.com/cilium/cilium/pull/33384 - envoy: Enable DaemonSet only for new installation                 
    https://github.com/cilium/cilium/pull/33333 - policy: Replace panics with error logs with stacktrace            
    https://github.com/cilium/cilium/pull/33304 - cni: Revert "cni: Use correct route MTU for various cloud cidrs"  
    https://github.com/cilium/cilium/pull/33302 - Policy catch invalid port wildcard                                
    https://github.com/cilium/cilium/pull/33263 - bgpv2: use peer asn and address in the key                        
    https://github.com/cilium/cilium/pull/33262 - bgpv1: reorder neighbor creation and deletion steps               
    https://github.com/cilium/cilium/pull/33237 - toFQDNs: Add documention and metrics for `fqdn` identities
    https://github.com/cilium/cilium/pull/32981 - Wait for CEC and CCEC resources before restoring endpoints.
    https://github.com/cilium/cilium/pull/31188 - docs: Document enable-node-selector-labels flag
😩 Error while running step "checking for release blockers": Found outstanding release blockers. Please resolve them before continuing release process. Reverting
 previous steps...
Error: Found outstanding release blockers. Please resolve them before continuing release process

A solution would be just to browse to https://github.com/cilium/cilium/issues?q=is:pull-request%20state:closed%20is:merged%20merged:%3E=2024-06-17%20base:main%20-label:backport-done%2F1.16%20label:release-blocker%2F1.16%20repo:cilium%2Fcilium and set all these PRs as backport-done/1.16.

[joestringer]

After resolving the above, now the precheck complains about blockers that are not yet merged:

$ release start --steps 1-pre-check --target-version v1.16.0-rc.1
💡 The PREVIOUS released version was v1.16.0-rc.0, continue? (Y/N): y
🏃 Running group "1-pre-check"
🏃 Running step "checking for release blockers"
  👀 Checking for opened GH issues and pull requests with the label "release-blocker/1.16" and for closed GH Pull Requests with that same label that are not backported yet but got merged in the 'main' branch after '2024-06-17': 
   https://github.com/cilium/cilium/labels/release-blocker/1.16
   https://github.com/cilium/cilium/issues?q=is%3Aopen+label:release-blocker/1.16+-is%3Adraft
   https://github.com/cilium/cilium/issues?q=is:pull-request%20state:closed%20is:merged%20merged:%3E=2024-06-17%20base:main%20-label:backport-done%2F1.16%20label:release-blocker%2F1.16%20repo:cilium%2Fcilium
    ⚠️ Found release blockers:
    https://github.com/cilium/cilium/issues/33257 - CI: Conformance E2E (ci-e2e) / outside-to-ingress-service
    https://github.com/cilium/cilium/issues/32943 - CI: NAT46x64 
    https://github.com/cilium/cilium/issues/32689 - CI: Cilium E2E Upgrade - no-errors-in-logs - retrieving device lxc_health: Link not found
    https://github.com/cilium/cilium/pull/33448 - policy: Fix parsing of CIDR labels
    https://github.com/cilium/cilium/pull/33447 - Fix container/bitlpm traversal
    https://github.com/cilium/cilium/pull/33389 - docs: Add Port Range Information
😩 Error while running step "checking for release blockers": Found outstanding release blockers. Please resolve them before continuing release process. Reverting previous steps...
Error: Found outstanding release blockers. Please resolve them before continuing release process

However for an RC we don't require all blockers to be resolved before each RC. Seems like we should have a way to ignore this (maybe we just keep the step in the RC process and just recognize that certain things can be ignored).

[joestringer]

Hmm. The new tooling doesn't understand git worktrees. It's trying to prepare the root copy of the repo for v1.16 instead of operating within the current directory. This causes problems when I have other stuff going on in the primary copy of the git repo.

$ git diff
$ git diff --cached
$ release start --steps 2-prepare-release --target-version v1.16.0-rc.1
💡 The PREVIOUS released version was v1.16.0-rc.0, continue? (Y/N): y
🏃 Running group "2-prepare-release"
🏃 Running step "preparing release commit"
  📤 Submitting changes to a PR
    ⬇️ Fetching branch
Checking "aanm\tgit@github.com/aanm/cilium (fetch)" against "github.com/cilium/cilium "
Checking "aanm\tgit@github.com/aanm/cilium (push)" against "github.com/cilium/cilium "
Checking "origin\tgit@github.com/joestringer/cilium (fetch)" against "github.com/cilium/cilium "
Checking "origin\tgit@github.com/joestringer/cilium (push)" against "github.com/cilium/cilium "
Checking "upstream\tgit@github.com/cilium/cilium (fetch)" against "github.com/cilium/cilium "
      🧑‍💻 Running command: git fetch -q upstream
      🧑‍💻 Running command: git checkout -b pr/prepare-v1.16.0-rc.1 upstream/v1.16
😩 Error while running step "preparing release commit": unable to run command: exit status 1

error: Your local changes to the following files would be overwritten by checkout: .github/workflows/tests-smoke.yaml Makefile Please commit your changes or stash them before you switch branches. Aborting

. Reverting previous steps...
Error: unable to run command: exit status 1

error: Your local changes to the following files would be overwritten by checkout: .github/workflows/tests-smoke.yaml Makefile Please commit your changes or stash them before you switch branches. Aborting

EDIT: Never mind, this is not to do with worktrees. The new version of the tooling assumes that the cilium directory is in ../cilium, which is a bad assumption. Overriding the repo directory fixes this.

[joestringer]

Prepare post-release changes to main branch using ../release/internal/bump-readme.sh.

This script doesn't detect development versions.