Prepare for release v1.13.15

Signed-off-by: Andrew Sauber <[email protected]>
cilium · Apr 11, 2024 · 8b532b5 · 8b532b5
1 parent 33c7352
commit 8b532b5
Show file tree

Hide file tree

Showing 10 changed files with 87 additions and 43 deletions.
diff --git a/.github/maintainers-little-helper.yaml b/.github/maintainers-little-helper.yaml
@@ -1,4 +1,4 @@
-project: "https://github.com/cilium/cilium/projects/278"
+project: "https://github.com/cilium/cilium/projects/281"
 column: "In progress"
 auto-label:
  - "kind/backports"

diff --git a/AUTHORS b/AUTHORS
@@ -449,7 +449,7 @@ Pranavi Roy [email protected]
 Pratyush Singhal [email protected]
 Qasim Sarfraz [email protected]
 Qifeng Guo [email protected]
-Quentin Monnet [email protected]
+Quentin Monnet [email protected]
 Raam [email protected]
 Rachid Zarouali [email protected]
 Raghu Gyambavantha [email protected]

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,47 @@
 # Changelog
 
+## v1.13.15
+
+Summary of Changes
+------------------
+
+**Minor Changes:**
+* [v1.13] Bump envoy to v1.27.x (#31498, @sayboras)
+
+**Bugfixes:**
+* cilium-health: Fix broken retry loop in `cilium-health-ep` controller (Backport PR #31722, Upstream PR #31622, @gandro)
+* Fixed a race condition in service updates for L7 LB. (Backport PR #31862, Upstream PR #31744, @jrajahalme)
+* Fixed issue with assigning 0 nodeID when corresponding bpf map run out of space.  Potentially it could have impacted connectivity in large clusters (>4k nodes) with IPSec or Mutual Auth enabled. Otherwise, it was merely generating unnecessary error log messages. (Backport PR #31657, Upstream PR #31380, @marseel)
+
+**CI Changes:**
+* ci/ipsec: Print more info to debug credentials removal check failures (Backport PR #31722, Upstream PR #31652, @qmonnet)
+* controlplane: fix mechanism for ensuring watchers (Backport PR #31587, Upstream PR #31030, @bimmlerd)
+* deflake endpointmanager tests (Backport PR #31722, Upstream PR #31488, @bimmlerd)
+* Reduce flakiness of controlplane tests (Backport PR #31587, Upstream PR #30906, @bimmlerd)
+* workflows: Debug info for key rotations (Backport PR #31722, Upstream PR #31627, @pchaigno)
+
+**Misc Changes:**
+* chore(deps): update all github action dependencies (v1.13) (#31835, @renovate[bot])
+* chore(deps): update cilium/little-vm-helper action to v0.0.17 (v1.13) (#31709, @renovate[bot])
+* chore(deps): update go to v1.21.9 (v1.13) (#31766, @renovate[bot])
+* chore(deps): update stable lvh-images (v1.13) (patch) (#31710, @renovate[bot])
+* docs: Document `No node ID found` drops in case of remote node deletion (Backport PR #31722, Upstream PR #31635, @pchaigno)
+* docs: ipsec: document native-routing + Egress proxy case (Backport PR #31722, Upstream PR #31478, @julianwiedmann)
+* helm: update nodeinit image using renovate (Backport PR #31722, Upstream PR #31641, @tklauser)
+* Restructure OpenShift installation instructions to point to Red Hat Ecosystem Catalog (Backport PR #31722, Upstream PR #29300, @learnitall)
+* v1.13: update cilium/certgen to v0.1.11 (#31884, @rolinh)
+
+**Other Changes:**
+* [v1.13] envoy: Bump envoy image for golang 1.21.9 (#31772, @sayboras)
+* [v1.13] fix aws region being used twice (#31740, @brlbil)
+* [v1.13] workflows: ipsec-e2e: clean up escaping artifacts (#31630, @julianwiedmann)
+* Bump google.golang.org/grpc to v1.63.2 (v1.13) (#31878, @ferozsalam)
+* CI: Remove no longer supported k8s v1.24 (#31830, @brlbil)
+* envoy: Bump envoy version to v1.27.4 (#31809, @sayboras)
+* fqdn: Fix minor restore bug that causes false negative checks against a restored DNS IP map. (#31872, @nathanjsweet)
+* fqdn: Fixed bug that caused DNS Proxy to be overly restrictive on allowed DNS selectors. (#31713, @nathanjsweet)
+* Update image digests for v1.13.14 (#31631, @thorn3r)
+
 ## v1.13.14
 
 Summary of Changes

diff --git a/Documentation/helm-values.rst b/Documentation/helm-values.rst
diff --git a/Documentation/network/kubernetes/compatibility-table.rst b/Documentation/network/kubernetes/compatibility-table.rst
@@ -144,6 +144,8 @@
 +-----------------+----------------+
 | v1.13.13 | 1.26.7 |
 +-----------------+----------------+
+| v1.13.14 | 1.26.8 |
++-----------------+----------------+
 | v1.13 | 1.26.8 |
 +-----------------+----------------+
 | latest / master | 1.26.9 |

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.13.14
+1.13.15
diff --git a/install/kubernetes/Makefile.digests b/install/kubernetes/Makefile.digests
@@ -2,12 +2,12 @@
 # Copyright 2024 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-export CILIUM_DIGEST := "sha256:75fc1088eec85faf2393552990bc1ecf457f32413b859a54e76a4b03bc001669"
-export CLUSTERMESH_APISERVER_DIGEST := "sha256:9c75b6c01990c740b052fa7abcd5467f2e8a7d064ee351779daac9132448b6bb"
-export DOCKER_PLUGIN_DIGEST := "sha256:5793e142d74aaf15e051066722f27b716af05f81c17551251303739c4579d6a4"
-export HUBBLE_RELAY_DIGEST := "sha256:51279d0c92f1468dd4a3b4ead091bded03b4bfd8477eb6bae2c50e715bb32679"
-export OPERATOR_ALIBABACLOUD_DIGEST := "sha256:124fc5b48c431f3051d94569cc4c764ee40d7cd4654f283b2c86ade935f3f1ec"
-export OPERATOR_AWS_DIGEST := "sha256:579de91ac57aa17a6915c026cdd675d851d54bd89bbcf4867c80b21e38fedf03"
-export OPERATOR_AZURE_DIGEST := "sha256:b6761b5f24c88c8f86e091da43960be6bbbb7cffaaf4446c63c1bf995fedb3bc"
-export OPERATOR_GENERIC_DIGEST := "sha256:d4112d05620f8db5d4219b7260b035048483cea49936bd55ddb5b81e1e559e2c"
-export OPERATOR_DIGEST := "sha256:ebb52050d7cdc943c66901dfe0a42d639516967b836bf5014db93d5d714c7967"
+export CILIUM_DIGEST := ""
+export CLUSTERMESH_APISERVER_DIGEST := ""
+export DOCKER_PLUGIN_DIGEST := ""
+export HUBBLE_RELAY_DIGEST := ""
+export OPERATOR_ALIBABACLOUD_DIGEST := ""
+export OPERATOR_AWS_DIGEST := ""
+export OPERATOR_AZURE_DIGEST := ""
+export OPERATOR_GENERIC_DIGEST := ""
+export OPERATOR_DIGEST := ""
diff --git a/install/kubernetes/cilium/Chart.yaml b/install/kubernetes/cilium/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: cilium
 displayName: Cilium
 home: https://cilium.io/
-version: 1.13.14
-appVersion: 1.13.14
+version: 1.13.15
+appVersion: 1.13.15
 kubeVersion: ">= 1.16.0-0"
 icon: https://cdn.jsdelivr.net/gh/cilium/[email protected]/Documentation/images/logo-solo.svg
 description: eBPF-based Networking, Security, and Observability

diff --git a/install/kubernetes/cilium/README.md b/install/kubernetes/cilium/README.md
@@ -1,6 +1,6 @@
 # cilium
 
-![Version: 1.13.14](https://img.shields.io/badge/Version-1.13.14-informational?style=flat-square) ![AppVersion: 1.13.14](https://img.shields.io/badge/AppVersion-1.13.14-informational?style=flat-square)
+![Version: 1.13.15](https://img.shields.io/badge/Version-1.13.15-informational?style=flat-square) ![AppVersion: 1.13.15](https://img.shields.io/badge/AppVersion-1.13.15-informational?style=flat-square)
 
 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -111,7 +111,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraEnv | list | `[]` | Additional clustermesh-apiserver environment variables. |
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:9c75b6c01990c740b052fa7abcd5467f2e8a7d064ee351779daac9132448b6bb","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.13.14","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.13.15","useDigest":false}` | Clustermesh API server image. |
 | clustermesh.apiserver.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | clustermesh.apiserver.podAnnotations | object | `{}` | Annotations to be added to clustermesh-apiserver pods |
 | clustermesh.apiserver.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -292,7 +292,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraEnv | list | `[]` | Additional hubble-relay environment variables. |
 | hubble.relay.extraVolumeMounts | list | `[]` | Additional hubble-relay volumeMounts. |
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
-| hubble.relay.image | object | `{"digest":"sha256:51279d0c92f1468dd4a3b4ead091bded03b4bfd8477eb6bae2c50e715bb32679","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.13.14","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.13.15","useDigest":false}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -387,7 +387,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
-| image | object | `{"digest":"sha256:75fc1088eec85faf2393552990bc1ecf457f32413b859a54e76a4b03bc001669","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.14","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.15","useDigest":false}` | Agent container image. |
 | imagePullSecrets | string | `nil` | Configure image pull secrets for pulling container images |
 | ingressController.enabled | bool | `false` | Enable cilium ingress controller This will automatically set enable-envoy-config as well. |
 | ingressController.enforceHttps | bool | `true` | Enforce https for host having matching TLS host in Ingress. Incoming traffic to http listener will return 308 http error code with respective location in header. |
@@ -480,7 +480,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.extraVolumes | list | `[]` | Additional cilium-operator volumes. |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:124fc5b48c431f3051d94569cc4c764ee40d7cd4654f283b2c86ade935f3f1ec","awsDigest":"sha256:579de91ac57aa17a6915c026cdd675d851d54bd89bbcf4867c80b21e38fedf03","azureDigest":"sha256:b6761b5f24c88c8f86e091da43960be6bbbb7cffaaf4446c63c1bf995fedb3bc","genericDigest":"sha256:d4112d05620f8db5d4219b7260b035048483cea49936bd55ddb5b81e1e559e2c","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.13.14","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"","awsDigest":"","azureDigest":"","genericDigest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.13.15","useDigest":false}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -526,7 +526,7 @@ contributors across the globe, there is almost always someone available to help.
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:75fc1088eec85faf2393552990bc1ecf457f32413b859a54e76a4b03bc001669","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.14","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.15","useDigest":false}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |

diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml
@@ -125,11 +125,11 @@ rollOutCiliumPods: false
 image:
  override: ~
  repository: "quay.io/cilium/cilium"
- tag: "v1.13.14"
+ tag: "v1.13.15"
  pullPolicy: "IfNotPresent"
  # cilium-digest
- digest: "sha256:75fc1088eec85faf2393552990bc1ecf457f32413b859a54e76a4b03bc001669"
- useDigest: true
+ digest: ""
+ useDigest: false
 
 # -- Affinity for cilium-agent.
 affinity:
@@ -1041,10 +1041,10 @@ hubble:
  image:
  override: ~
  repository: "quay.io/cilium/hubble-relay"
- tag: "v1.13.14"
+ tag: "v1.13.15"
  # hubble-relay-digest
- digest: "sha256:51279d0c92f1468dd4a3b4ead091bded03b4bfd8477eb6bae2c50e715bb32679"
- useDigest: true
+ digest: ""
+ useDigest: false
  pullPolicy: "IfNotPresent"
 
  # -- Specifies the resources for the hubble-relay pods
@@ -1898,16 +1898,16 @@ operator:
  image:
  override: ~
  repository: "quay.io/cilium/operator"
- tag: "v1.13.14"
+ tag: "v1.13.15"
  # operator-generic-digest
- genericDigest: "sha256:d4112d05620f8db5d4219b7260b035048483cea49936bd55ddb5b81e1e559e2c"
+ genericDigest: ""
  # operator-azure-digest
- azureDigest: "sha256:b6761b5f24c88c8f86e091da43960be6bbbb7cffaaf4446c63c1bf995fedb3bc"
+ azureDigest: ""
  # operator-aws-digest
- awsDigest: "sha256:579de91ac57aa17a6915c026cdd675d851d54bd89bbcf4867c80b21e38fedf03"
+ awsDigest: ""
  # operator-alibabacloud-digest
- alibabacloudDigest: "sha256:124fc5b48c431f3051d94569cc4c764ee40d7cd4654f283b2c86ade935f3f1ec"
- useDigest: true
+ alibabacloudDigest: ""
+ useDigest: false
  pullPolicy: "IfNotPresent"
  suffix: ""
 
@@ -2163,10 +2163,10 @@ preflight:
  image:
  override: ~
  repository: "quay.io/cilium/cilium"
- tag: "v1.13.14"
+ tag: "v1.13.15"
  # cilium-digest
- digest: "sha256:75fc1088eec85faf2393552990bc1ecf457f32413b859a54e76a4b03bc001669"
- useDigest: true
+ digest: ""
+ useDigest: false
  pullPolicy: "IfNotPresent"
 
  # -- The priority class to use for the preflight pod.
@@ -2310,10 +2310,10 @@ clustermesh:
  image:
  override: ~
  repository: "quay.io/cilium/clustermesh-apiserver"
- tag: "v1.13.14"
+ tag: "v1.13.15"
  # clustermesh-apiserver-digest
- digest: "sha256:9c75b6c01990c740b052fa7abcd5467f2e8a7d064ee351779daac9132448b6bb"
- useDigest: true
+ digest: ""
+ useDigest: false
  pullPolicy: "IfNotPresent"
 
  etcd: