Prepare for release v1.15.4

Signed-off-by: Andrew Sauber <[email protected]>

.github/maintainers-little-helper.yaml

@@ -1,4 +1,4 @@
-project: "https://github.com/cilium/cilium/projects/277"
+project: "https://github.com/cilium/cilium/projects/282"
 column: "In progress"
 auto-label:
  - "kind/backports"

AUTHORS

@@ -141,6 +141,7 @@ Chris Werner Rau [email protected]
 ChrsMark [email protected]
 Cilium Imagebot [email protected]
 Cintia Sanchez Garcia [email protected]
+CJ Virtucio [email protected]
 Claudia J. Kang [email protected]
 Clément Delzotti [email protected]
 cleverhu [email protected]
@@ -371,6 +372,7 @@ Karim Naufal [email protected]
 Karl Heins [email protected]
 Karsten Nielsen [email protected]
 Katarzyna Borkmann [email protected]
+Katie Struthers [email protected]
 Kazuki Suda [email protected]
 Keisuke Kondo [email protected]
 Kenshin Chen [email protected]
@@ -589,7 +591,7 @@ Richard Lavoie [email protected]
 Richard Tweed [email protected]
 Ricky Ho [email protected]
 Rio Kierkels [email protected]
-Robin Gögge r.goegge@gmail.com
+Robin Gögge r.goegge@isovalent.com
 Robin Hahling [email protected]
 Rocky Chen [email protected]
 Rodrigo Chacon [email protected]
@@ -658,7 +660,7 @@ Sven Haardiek [email protected]
 Swaminathan Vasudevan [email protected]
 Taeung Song [email protected]
 Takayoshi Nishida [email protected]
-Tamilmani tamanoha@microsoft.comwq
+Tamilmani tamanoha@microsoft.com
 Tam Mach [email protected]
 Tasdik Rahman [email protected]
 Te-Yu Chang [email protected]
@@ -706,7 +708,7 @@ Viktor Kuzmin [email protected]
 Viktor Oreshkin [email protected]
 Ville Ojamo [email protected]
 Vincent Li [email protected]
-Vipul Singh singhvipul@microsoft.com
+Vipul Singh vipul21sept@gmail.com
 Vishal Choudhary [email protected]
 Vishnu Soman K [email protected]
 Vlad Artamonov [email protected]
@@ -735,6 +737,7 @@ Xiaoyang Zhu [email protected]
 XiaozhiD-web [email protected]
 Xin Li [email protected]
 Xinyuan Zhang [email protected]
+xyz-li [email protected]
 yanggang [email protected]
 yanhongchang [email protected]
 Yash Shetty [email protected]

CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## v1.15.4
+
+Summary of Changes
+------------------
+
+**Minor Changes:**
+* Add "node-map-max" to allow configuring nodemap size. (Backport PR #31727, Upstream PR #31407, @tommyp1ckles)
+* Add line numbers and file names to all metrics in 'cilium-dbg bpf metrics list' (Backport PR #31558, Upstream PR #30972, @ti-mo)
+* bugtool: Collect hubble metrics (Backport PR #31890, Upstream PR #31533, @chancez)
+* feat: Add the http return code to metric api_processed_total (Backport PR #31890, Upstream PR #31227, @vipul-21)
+* Fix overlapping keys in agent-side service BPF map cache used for retries. In rare cases this bug may have caused retrying of a failed BPF map update for a services entry to be skipped leading to a missing entry. This may have, for example, adversely affected recovering from a full BPF service map after excess services were removed. (Backport PR #31890, Upstream PR #29581, @xyz-li)
+* Skip overlay traffic in the BPF SNAT processing, and thus reduce pressure on the BPF Connection tracking and NAT maps. (Backport PR #31785, Upstream PR #31082, @julianwiedmann)
+
+**Bugfixes:**
+* Avoid drops with "CT: Unknown L4 protocol" for non-ICMP/TCP/UDP traffic, caused by an error check in the BPF NAT engine. (Backport PR #31890, Upstream PR #31820, @julianwiedmann)
+* cilium-health: Fix broken retry loop in `cilium-health-ep` controller (Backport PR #31727, Upstream PR #31622, @gandro)
+* cni: Allow text-ts log format value (Backport PR #31890, Upstream PR #31686, @sayboras)
+* Fix a bug that could cause local packet delivery to be skipped, leading to lower performance, when IPsec was enabled and `--devices` provided. (Backport PR #31601, Upstream PR #31345, @pchaigno)
+* Fix incorrect reporting of the number of etcd lock leases in cilium-dbg status. (Backport PR #31890, Upstream PR #31781, @giorio94)
+* fix: Delegated ipam not configure ipv6 if ipv6 disabled in agent (Backport PR #31727, Upstream PR #31104, @tamilmani1989)
+* Fixed a race condition in service updates for L7 LB. (Backport PR #31860, Upstream PR #31744, @jrajahalme)
+* fqdn: Fix minor restore bug that causes false negative checks against a restored DNS IP map. (#31870, @nathanjsweet)
+* fqdn: Fixed bug that caused DNS Proxy to be overly restrictive on allowed DNS selectors. (Backport PR #31727, Upstream PR #31328, @nathanjsweet)
+* gateway-api: Ensure hostname check when set on both the HTTPRoute and the Gateway Listener (Backport PR #31769, Upstream PR #30686, @cjvirtucio87)
+* gateway-api: fixed RequestRedirect picks wrong port with multiple listeners (Backport PR #31769, Upstream PR #31361, @chaunceyjiang)
+* gateway-api: shorten the length of the value of the svc's label. (Backport PR #31769, Upstream PR #31292, @chaunceyjiang)
+* ingress/gateway-api: sort virtual hosts in CEC (Backport PR #31739, Upstream PR #31493, @mhofstetter)
+* ingress/gateway-api: stable envoy listener filterchain sort-order (Backport PR #31601, Upstream PR #31572, @mhofstetter)
+* metric: Avoid memory leak/increase in cilium-agent (Backport PR #31890, Upstream PR #31714, @sayboras)
+
+**CI Changes:**
+* ci-e2e: Add e2e test with WireGuard + Host Firewall (Backport PR #31727, Upstream PR #31594, @qmonnet)
+* ci/ipsec: Print more info to debug credentials removal check failures (Backport PR #31727, Upstream PR #31652, @qmonnet)
+* deflake endpointmanager tests (Backport PR #31601, Upstream PR #31488, @bimmlerd)
+* gh/workflows: Add IPsec key rotation action and use it in ci-eks / ci-ipsec-e2e (Backport PR #31428, Upstream PR #29704, @brb)
+* Make BPF unit tests reproducible (Backport PR #31663, Upstream PR #31526, @ti-mo)
+* Make testdata build output more stable by reducing header includes (Backport PR #31663, Upstream PR #31644, @ti-mo)
+* update azure k8s versions (Backport PR #31890, Upstream PR #31220, @brlbil)
+* workflows: Debug info for key rotations (Backport PR #31727, Upstream PR #31627, @pchaigno)
+* workflows: ipsec-e2e: add missing key types for some configs (Backport PR #31727, Upstream PR #31636, @julianwiedmann)
+
+**Misc Changes:**
+* bitlpm: Document and Fix Descendants Bug (Backport PR #31890, Upstream PR #31851, @nathanjsweet)
+* bpf: host: restore HostFW for overlay traffic in to-netdev (Backport PR #31785, Upstream PR #31818, @julianwiedmann)
+* bpf: tests: don't define HAVE_ENCAP in IPsec tests (Backport PR #31785, Upstream PR #31737, @julianwiedmann)
+* chore(deps): update all github action dependencies (v1.15) (#31822, @renovate[bot])
+* chore(deps): update all-dependencies (v1.15) (#31698, @renovate[bot])
+* chore(deps): update cilium/little-vm-helper action to v0.0.17 (v1.15) (#31703, @renovate[bot])
+* chore(deps): update dependency cilium/cilium-cli to v0.16.4 (v1.15) (#31674, @renovate[bot])
+* chore(deps): update docker/setup-buildx-action action to v3.3.0 (v1.15) (#31828, @renovate[bot])
+* chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to f41b84c (v1.15) (#31747, @renovate[bot])
+* chore(deps): update go to v1.21.9 (v1.15) (#31764, @renovate[bot])
+* chore(deps): update stable lvh-images (v1.15) (patch) (#31704, @renovate[bot])
+* cilium-dbg: avoid leaking file resources (Backport PR #31890, Upstream PR #31750, @tklauser)
+* docs: Document `No node ID found` drops in case of remote node deletion (Backport PR #31727, Upstream PR #31635, @pchaigno)
+* docs: ipsec: document native-routing + Egress proxy case (Backport PR #31727, Upstream PR #31478, @julianwiedmann)
+* Fix spelling in DNS-based proxy info (Backport PR #31890, Upstream PR #31728, @saintdle)
+* helm: update nodeinit image using renovate (Backport PR #31727, Upstream PR #31641, @tklauser)
+* ingress: sort all shared ingresses during model generation (Backport PR #31727, Upstream PR #31494, @mhofstetter)
+* loader: refactor/cleanup replaceNetworkDatapath (Backport PR #31663, Upstream PR #29825, @rgo3)
+* Move governance docs to the Cilium community repo (Backport PR #31890, Upstream PR #31692, @katiestruthers)
+* Remove Hubble-OTel from the roadmap (Backport PR #31890, Upstream PR #31847, @xmulligan)
+* Remove tcx links created by Cilium 1.16 onwards (Backport PR #31663, Upstream PR #31553, @ti-mo)
+* Restructure OpenShift installation instructions to point to Red Hat Ecosystem Catalog (Backport PR #31727, Upstream PR #29300, @learnitall)
+* v1.15: update cilium/certgen to v0.1.11 (#31882, @rolinh)
+
+**Other Changes:**
+* [v1.15] envoy: Bump envoy image for golang 1.21.9 (#31770, @sayboras)
+* [v1.15] Multicast Datapath Backport (#31668, @ldelossa)
+* [v1.15] route: Specify "proto kernel" for ip routes and rules (#31777, @jschwinger233)
+* envoy: Bump envoy version to v1.27.4 (#31807, @sayboras)
+* install: Update image digests for v1.15.3 (#31623, @jrajahalme)
+
 ## v1.15.3
 
 Summary of Changes

Documentation/network/kubernetes/compatibility-table.rst

@@ -42,6 +42,8 @@
 +--------------------+----------------+
 | v1.13.13 | 1.26.7 |
 +--------------------+----------------+
+| v1.13.14 | 1.26.8 |
++--------------------+----------------+
 | v1.13 | 1.26.8 |
 +--------------------+----------------+
 | v1.14.0-pre.2 | 1.26.8 |
@@ -82,6 +84,8 @@
 +--------------------+----------------+
 | v1.14.8 | 1.27.0 |
 +--------------------+----------------+
+| v1.14.9 | 1.27.1 |
++--------------------+----------------+
 | v1.14 | 1.27.1 |
 +--------------------+----------------+
 | v1.15.0-pre.0 | 1.26.9 |
@@ -102,6 +106,8 @@
 +--------------------+----------------+
 | v1.15.2 | 1.28.1 |
 +--------------------+----------------+
+| v1.15.3 | 1.28.2 |
++--------------------+----------------+
 | v1.15 | 1.28.2 |
 +--------------------+----------------+
 | latest / main | 1.29.4 |

VERSION

@@ -1 +1 @@
-1.15.3
+1.15.4

install/kubernetes/Makefile.digests

@@ -2,12 +2,12 @@
 # Copyright 2024 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-export CILIUM_DIGEST := "sha256:da74ab61d1bc665c1c088dff41d5be388d252ca5800f30c7d88844e6b5e440b0"
-export CLUSTERMESH_APISERVER_DIGEST := "sha256:da4573f8fe4415bdb786c4fdcbc3b518e5a485f930cd4292416eb80800cbd7fc"
-export DOCKER_PLUGIN_DIGEST := "sha256:1d302b643fe70c6036c5e991520fbf87df92f0fd862ee7b96a5d9c937211f91a"
-export HUBBLE_RELAY_DIGEST := "sha256:b9c6431aa4f22242a5d0d750c621d9d04bdc25549e4fb1116bfec98dd87958a2"
-export OPERATOR_ALIBABACLOUD_DIGEST := "sha256:59d5c0c5782163d38151dd06bae0118144f6c080598901a632c628b1143ccd10"
-export OPERATOR_AWS_DIGEST := "sha256:2b05dc6b88037a5ce05e4030ef616b1f7be9e65083e35abd36a1b66953fd0b6a"
-export OPERATOR_AZURE_DIGEST := "sha256:b85a2671a74903c6e9a45e884654bb970b5b8d6a6e20371811a6cc0ad92b2f87"
-export OPERATOR_GENERIC_DIGEST := "sha256:c97f23161906b82f5c81a2d825b0646a5aa1dfb4adf1d49cbb87815079e69d61"
-export OPERATOR_DIGEST := "sha256:3d1f8f3c208064a78ae851b2e3cef28d5f484a0a368164fb8f95b92d1a974251"
+export CILIUM_DIGEST := ""
+export CLUSTERMESH_APISERVER_DIGEST := ""
+export DOCKER_PLUGIN_DIGEST := ""
+export HUBBLE_RELAY_DIGEST := ""
+export OPERATOR_ALIBABACLOUD_DIGEST := ""
+export OPERATOR_AWS_DIGEST := ""
+export OPERATOR_AZURE_DIGEST := ""
+export OPERATOR_GENERIC_DIGEST := ""
+export OPERATOR_DIGEST := ""

install/kubernetes/cilium/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: cilium
 displayName: Cilium
 home: https://cilium.io/
-version: 1.15.3
-appVersion: 1.15.3
+version: 1.15.4
+appVersion: 1.15.4
 kubeVersion: ">= 1.16.0-0"
 icon: https://cdn.jsdelivr.net/gh/cilium/[email protected]/Documentation/images/logo-solo.svg
 description: eBPF-based Networking, Security, and Observability