Closed renovate[bot] closed 3 weeks ago
This PR contains the following updates:
1.15.4
1.15.6
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.
This PR contains the following updates:
1.15.4->1.15.6Release Notes
cilium/cilium (cilium)
### [`v1.15.6`](https://togithub.com/cilium/cilium/compare/1.15.5...1.15.6) [Compare Source](https://togithub.com/cilium/cilium/compare/1.15.5...1.15.6) ### [`v1.15.5`](https://togithub.com/cilium/cilium/releases/tag/v1.15.5): 1.15.5 [Compare Source](https://togithub.com/cilium/cilium/compare/1.15.4...1.15.5) We are pleased to announce the release of Cilium v1.15.5. This release fixes a lot of bugs, including fixes for conflicting ports with DNS proxy, clustermesh startup issues, and StatefulSet handling. ## Security Advisories This release addresses following security vulnerabilities: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj - https://github.com/advisories/GHSA-5fq7-4mxc-535h ## Summary of Changes **Minor Changes:** - envoy: Bump go version to 1.22.3 ([#32413](https://togithub.com/cilium/cilium/issues/32413), [@sayboras](https://togithub.com/sayboras)) - labels: Add controller-uid into default ignore list (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#31964](https://togithub.com/cilium/cilium/issues/31964), [@sayboras](https://togithub.com/sayboras)) **Bugfixes:** - Agent: add kubeconfigPath to initContainers (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32008](https://togithub.com/cilium/cilium/issues/32008), [@darox](https://togithub.com/darox)) - Avoids drops with "No mapping for NAT masquerade" for ICMP messages by local service backends. (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32155](https://togithub.com/cilium/cilium/issues/32155), [@julianwiedmann](https://togithub.com/julianwiedmann)) - cilium-cni: Reserve ports that can conflict with transparent DNS proxy (Backport PR [#32418](https://togithub.com/cilium/cilium/issues/32418), Upstream PR [#32128](https://togithub.com/cilium/cilium/issues/32128), [@gandro](https://togithub.com/gandro)) - cni: Use correct route MTU when ENI, Azure or Alibaba Cloud IPAM is enabled (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32244](https://togithub.com/cilium/cilium/issues/32244), [@learnitall](https://togithub.com/learnitall)) - dnsproxy: Fix bug where DNS request timed out too soon (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#31999](https://togithub.com/cilium/cilium/issues/31999), [@gandro](https://togithub.com/gandro)) - Envoy upstream connections are now unique for each downstream connection when using the original source address of a source pod. (Backport PR [#32312](https://togithub.com/cilium/cilium/issues/32312), Upstream PR [#32270](https://togithub.com/cilium/cilium/issues/32270), [@jrajahalme](https://togithub.com/jrajahalme)) - envoy: pass idle timeout configuration option to cilium configmap (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32203](https://togithub.com/cilium/cilium/issues/32203), [@mhofstetter](https://togithub.com/mhofstetter)) - Fix failing service connections, when the service requests are transported via cilium's overlay network. (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32116](https://togithub.com/cilium/cilium/issues/32116), [@julianwiedmann](https://togithub.com/julianwiedmann)) - Fix issue causing clustermesh-apiserver/kvstoremesh to not start when run with a non-root user (Backport PR [#31879](https://togithub.com/cilium/cilium/issues/31879), Upstream PR [#31539](https://togithub.com/cilium/cilium/issues/31539), [@giorio94](https://togithub.com/giorio94)) - Fix service connection to terminating backend, when the service has no more backends available. (Backport PR [#32092](https://togithub.com/cilium/cilium/issues/32092), Upstream PR [#31840](https://togithub.com/cilium/cilium/issues/31840), [@julianwiedmann](https://togithub.com/julianwiedmann)) - Fix various bugs related to restart of StatefulSet pods that may result in connectivity issues (Backport PR [#32432](https://togithub.com/cilium/cilium/issues/32432), Upstream PR [#31605](https://togithub.com/cilium/cilium/issues/31605), [@christarazi](https://togithub.com/christarazi)) - Fixes a bug where Cilium in chained mode removed the `agent-not-ready` taint too early if the primary network is slow in deploying. (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32168](https://togithub.com/cilium/cilium/issues/32168), [@squeed](https://togithub.com/squeed)) - Fixes an (unlikely) bug where HostFirewall policies may miss updates to a node's labels. (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#30548](https://togithub.com/cilium/cilium/issues/30548), [@squeed](https://togithub.com/squeed)) - fqdn: fix memory leak in transparent mode when there was a moderately high number of parallel DNS requests (>100). (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#31959](https://togithub.com/cilium/cilium/issues/31959), [@marseel](https://togithub.com/marseel)) - Ingress/Gateway API: merge Envoy listeners for HTTP(S) and TLS passthrough (Backport PR [#32178](https://togithub.com/cilium/cilium/issues/32178), Upstream PR [#31646](https://togithub.com/cilium/cilium/issues/31646), [@mhofstetter](https://togithub.com/mhofstetter)) - ipam: retry netlink.LinkList call when setting up ENI devices (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32099](https://togithub.com/cilium/cilium/issues/32099), [@jasonaliyetti](https://togithub.com/jasonaliyetti)) - loader: sanitize bpffs directory strings for netdevs (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#32090](https://togithub.com/cilium/cilium/issues/32090), [@rgo3](https://togithub.com/rgo3)) - Prevent Cilium agents from incorrectly restarting an etcd watch against a different etcd instance. ([#32005](https://togithub.com/cilium/cilium/issues/32005), [@giorio94](https://togithub.com/giorio94)) - tables: Sort node addresses also by public vs private IP (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#30579](https://togithub.com/cilium/cilium/issues/30579), [@joamaki](https://togithub.com/joamaki)) **CI Changes:** - alibabacloud/eni: avoid racing node mgr in test (Backport PR [#31967](https://togithub.com/cilium/cilium/issues/31967), Upstream PR [#31877](https://togithub.com/cilium/cilium/issues/31877), [@bimmlerd](https://togithub.com/bimmlerd)) - ci: Filter supported versions of AKS (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32303](https://togithub.com/cilium/cilium/issues/32303), [@marseel](https://togithub.com/marseel)) - ci: Increase timeout for images for l4lb test (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32201](https://togithub.com/cilium/cilium/issues/32201), [@marseel](https://togithub.com/marseel)) - ci: Set hubble.relay.retryTimeout=5s (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32066](https://togithub.com/cilium/cilium/issues/32066), [@chancez](https://togithub.com/chancez)) - enable kube cache mutation detector (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32069](https://togithub.com/cilium/cilium/issues/32069), [@aanm](https://togithub.com/aanm)) - gha: bump post-upgrade timeout in clustermesh upgrade/downgrade tests (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32347](https://togithub.com/cilium/cilium/issues/32347), [@giorio94](https://togithub.com/giorio94)) - gha: configure fully-qualified DNS names as external targets (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#31510](https://togithub.com/cilium/cilium/issues/31510), [@giorio94](https://togithub.com/giorio94)) - gha: drop double installation of Cilium CLI in conformance-eks (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#32042](https://togithub.com/cilium/cilium/issues/32042), [@giorio94](https://togithub.com/giorio94)) - Miscellaneous improvements to the clustermesh upgrade/downgrade test (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#31958](https://togithub.com/cilium/cilium/issues/31958), [@giorio94](https://togithub.com/giorio94)) - route: dedicated net ns for each subtest of runListRules (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#29916](https://togithub.com/cilium/cilium/issues/29916), [@mhofstetter](https://togithub.com/mhofstetter)) - test: De-flake xds server_e2e_test (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#32004](https://togithub.com/cilium/cilium/issues/32004), [@jrajahalme](https://togithub.com/jrajahalme)) - workflows: Fix CI jobs for push events on private forks (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32085](https://togithub.com/cilium/cilium/issues/32085), [@pchaigno](https://togithub.com/pchaigno)) **Misc Changes:** - bpf: host: simplify MARK_MAGIC_PROXY_EGRESS_EPID handling (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#29803](https://togithub.com/cilium/cilium/issues/29803), [@julianwiedmann](https://togithub.com/julianwiedmann)) - build(deps): bump pydantic from 2.3.0 to 2.4.0 in /Documentation (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32176](https://togithub.com/cilium/cilium/issues/32176), [@dependabot](https://togithub.com/dependabot)\[bot]) - chore(deps): update all github action dependencies (v1.15) ([#31954](https://togithub.com/cilium/cilium/issues/31954), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update all github action dependencies (v1.15) ([#32107](https://togithub.com/cilium/cilium/issues/32107), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update all github action dependencies (v1.15) ([#32366](https://togithub.com/cilium/cilium/issues/32366), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update all-dependencies (v1.15) ([#31993](https://togithub.com/cilium/cilium/issues/31993), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update all-dependencies (v1.15) ([#32238](https://togithub.com/cilium/cilium/issues/32238), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update azure/login action to v2.1.0 (v1.15) ([#31994](https://togithub.com/cilium/cilium/issues/31994), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.16.6 (v1.15) ([#32365](https://togithub.com/cilium/cilium/issues/32365), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.21.9 docker digest to [`81811f8`](https://togithub.com/cilium/cilium/commit/81811f8) (v1.15) ([#31953](https://togithub.com/cilium/cilium/issues/31953), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.21.9 docker digest to [`d83472f`](https://togithub.com/cilium/cilium/commit/d83472f) (v1.15) ([#32257](https://togithub.com/cilium/cilium/issues/32257), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update docker.io/library/ubuntu:22.04 docker digest to [`a6d2b38`](https://togithub.com/cilium/cilium/commit/a6d2b38) (v1.15) ([#32364](https://togithub.com/cilium/cilium/issues/32364), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update go to v1.21.10 (v1.15) ([#32417](https://togithub.com/cilium/cilium/issues/32417), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update golangci/golangci-lint-action action to v6 (v1.15) ([#32396](https://togithub.com/cilium/cilium/issues/32396), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update hubble cli to v0.13.3 (v1.15) ([#32108](https://togithub.com/cilium/cilium/issues/32108), [@renovate](https://togithub.com/renovate)\[bot]) - chore(deps): update stable lvh-images (v1.15) (patch) ([#31821](https://togithub.com/cilium/cilium/issues/31821), [@renovate](https://togithub.com/renovate)\[bot]) - CI: bump default FQDN datapath timeout from 100 to 250ms (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#31866](https://togithub.com/cilium/cilium/issues/31866), [@squeed](https://togithub.com/squeed)) - clustermesh: fix panic if the etcd client cannot be created (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32225](https://togithub.com/cilium/cilium/issues/32225), [@giorio94](https://togithub.com/giorio94)) - docs: Add annotation for Ingress endpoint (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32284](https://togithub.com/cilium/cilium/issues/32284), [@sayboras](https://togithub.com/sayboras)) - docs: add link to sig-policy meeting (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32340](https://togithub.com/cilium/cilium/issues/32340), [@squeed](https://togithub.com/squeed)) - docs: Clean-up Host Firewall documentation, list known issues (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32267](https://togithub.com/cilium/cilium/issues/32267), [@qmonnet](https://togithub.com/qmonnet)) - docs: Fix prometheus port regex (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32030](https://togithub.com/cilium/cilium/issues/32030), [@JBodkin-Amphora](https://togithub.com/JBodkin-Amphora)) - Docs: mark Tetragon as Stable (Backport PR [#31967](https://togithub.com/cilium/cilium/issues/31967), Upstream PR [#31886](https://togithub.com/cilium/cilium/issues/31886), [@sharlns](https://togithub.com/sharlns)) - Document Cluster Mesh global services limitations when KPR=false (Backport PR [#31967](https://togithub.com/cilium/cilium/issues/31967), Upstream PR [#31798](https://togithub.com/cilium/cilium/issues/31798), [@giorio94](https://togithub.com/giorio94)) - endpoint: Skip build queue warning log is context is canceled (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32132](https://togithub.com/cilium/cilium/issues/32132), [@jrajahalme](https://togithub.com/jrajahalme)) - Fix helm chart incompatible types for comparison (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32025](https://togithub.com/cilium/cilium/issues/32025), [@lou-lan](https://togithub.com/lou-lan)) - fqdn: Change error log to warning (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32333](https://togithub.com/cilium/cilium/issues/32333), [@jrajahalme](https://togithub.com/jrajahalme)) - fqdn: Fix Upgrade Issue Between PortProto Versions (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32325](https://togithub.com/cilium/cilium/issues/32325), [@nathanjsweet](https://togithub.com/nathanjsweet)) - golangci: Enable errorlint (Backport PR [#31783](https://togithub.com/cilium/cilium/issues/31783), Upstream PR [#31458](https://togithub.com/cilium/cilium/issues/31458), [@jrajahalme](https://togithub.com/jrajahalme)) - images: Update bpftool, checkpatch images (Backport PR [#31896](https://togithub.com/cilium/cilium/issues/31896), Upstream PR [#31753](https://togithub.com/cilium/cilium/issues/31753), [@qmonnet](https://togithub.com/qmonnet)) - Improve release organization page (Backport PR [#32103](https://togithub.com/cilium/cilium/issues/32103), Upstream PR [#31970](https://togithub.com/cilium/cilium/issues/31970), [@joestringer](https://togithub.com/joestringer)) - install/kubernetes: add AppArmor profile to Cilium Daemonset (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32199](https://togithub.com/cilium/cilium/issues/32199), [@aanm](https://togithub.com/aanm)) - install/kubernetes: update nodeinit image to latest version (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32181](https://togithub.com/cilium/cilium/issues/32181), [@tklauser](https://togithub.com/tklauser)) - ipsec: Debug info for transient IPsec upgrade drops (Backport PR [#32384](https://togithub.com/cilium/cilium/issues/32384), Upstream PR [#32240](https://togithub.com/cilium/cilium/issues/32240), [@pchaigno](https://togithub.com/pchaigno)) - l7 policy: add possibility to configure Envoy proxy xff-num-trusted-hops (Backport PR [#32260](https://togithub.com/cilium/cilium/issues/32260), Upstream PR [#32200](https://togithub.com/cilium/cilium/issues/32200), [@mhofstetter](https://togithub.com/mhofstetter)) - Remove aks-preview from AKS workflows (Backport PR [#32230](https://togithub.com/cilium/cilium/issues/32230), Upstream PR [#32118](https://togithub.com/cilium/cilium/issues/32118), [@marseel](https://togithub.com/marseel)) - Seamlessly downgrade bpf attachments from tcx to tc (Backport PR [#32337](https://togithub.com/cilium/cilium/issues/32337), Upstream PR [#32228](https://togithub.com/cilium/cilium/issues/32228), [@ti-mo](https://togithub.com/ti-mo)) **Other Changes:** - \[1.15] images: update cilium-{runtime,builder} ([#32444](https://togithub.com/cilium/cilium/issues/32444), [@nebril](https://togithub.com/nebril)) - \[v1.15-backport] Introduce fromEgressProxyRule ([#31922](https://togithub.com/cilium/cilium/issues/31922), [@jschwinger233](https://togithub.com/jschwinger233)) - \[v1.15] cilium-dbg: remove section with unknown health status. ([#31905](https://togithub.com/cilium/cilium/issues/31905), [@tommyp1ckles](https://togithub.com/tommyp1ckles)) - \[v1.15] proxy: skip rule removal if address family is not supported ([#32007](https://togithub.com/cilium/cilium/issues/32007), [@rgo3](https://togithub.com/rgo3)) - envoy: Bump envoy version to v1.27.5 ([#32077](https://togithub.com/cilium/cilium/issues/32077), [@sayboras](https://togithub.com/sayboras)) - envoy: Update envoy 1.27.x to 1.28.3 ([#32149](https://togithub.com/cilium/cilium/issues/32149), [@sayboras](https://togithub.com/sayboras)) - fix k8s versions tested in CI ([#31965](https://togithub.com/cilium/cilium/issues/31965), [@nbusseneau](https://togithub.com/nbusseneau)) - install: Update image digests for v1.15.4 ([#31915](https://togithub.com/cilium/cilium/issues/31915), [@asauber](https://togithub.com/asauber)) #### v1.15.5 #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.15.5@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40` `quay.io/cilium/cilium:stable@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.15.5@sha256:914549caf4376a844b5e7696019182dd2a655b89d6a3cad10f9d0f9821759fd7` `quay.io/cilium/clustermesh-apiserver:stable@sha256:914549caf4376a844b5e7696019182dd2a655b89d6a3cad10f9d0f9821759fd7` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.15.5@sha256:c301dc000eff2940a82fc51f4a937793fa3a7212d77000a5aa06ae6116032437` `quay.io/cilium/docker-plugin:stable@sha256:c301dc000eff2940a82fc51f4a937793fa3a7212d77000a5aa06ae6116032437` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.15.5@sha256:1d24b24e3477ccf9b5ad081827db635419c136a2bd84a3e60f37b26a38dd0781` `quay.io/cilium/hubble-relay:stable@sha256:1d24b24e3477ccf9b5ad081827db635419c136a2bd84a3e60f37b26a38dd0781` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.15.5@sha256:d76d45e308f23398b786f1f05504863759849046c20c741ebb64ad80613f8fd3` `quay.io/cilium/operator-alibabacloud:stable@sha256:d76d45e308f23398b786f1f05504863759849046c20c741ebb64ad80613f8fd3` ##### operator-aws `quay.io/cilium/operator-aws:v1.15.5@sha256:f9c0eaea023ce5a75b3ed1fc4b783f390c5a3c7dc1507a2dc4dbc667b80d1bd9` `quay.io/cilium/operator-aws:stable@sha256:f9c0eaea023ce5a75b3ed1fc4b783f390c5a3c7dc1507a2dc4dbc667b80d1bd9` ##### operator-azure `quay.io/cilium/operator-azure:v1.15.5@sha256:0a56f2cfdcdf13da21b7fdcc870e29fef82e71e599cd8dd74eb65c377e035522` `quay.io/cilium/operator-azure:stable@sha256:0a56f2cfdcdf13da21b7fdcc870e29fef82e71e599cd8dd74eb65c377e035522` ##### operator-generic `quay.io/cilium/operator-generic:v1.15.5@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8` `quay.io/cilium/operator-generic:stable@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8` ##### operator `quay.io/cilium/operator:v1.15.5@sha256:6f480128aa3d3b2c50a8dfa0bd5bc5121e48b1ee0bbc8eec9cae72e904bf10c3` `quay.io/cilium/operator:stable@sha256:6f480128aa3d3b2c50a8dfa0bd5bc5121e48b1ee0bbc8eec9cae72e904bf10c3`Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.