chore(deps): update helm release cilium to v1.15.5

[damoun-bot]

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	1.15.2 -> 1.15.5

---

Release Notes

cilium/cilium (cilium)

v1.15.5: 1.15.5

Compare Source

We are pleased to announce the release of Cilium v1.15.5.

This release fixes a lot of bugs, including fixes for conflicting ports with DNS proxy, clustermesh startup issues, and StatefulSet handling.

Security Advisories

This release addresses following security vulnerabilities:

• GHSA-3mh5-6q8v-25wj
• GHSA-5fq7-4mxc-535h

Summary of Changes

Minor Changes:

• envoy: Bump go version to 1.22.3 (#​32413, @​sayboras)
• labels: Add controller-uid into default ignore list (Backport PR #​32103, Upstream PR #​31964, @​sayboras)

Bugfixes:

• Agent: add kubeconfigPath to initContainers (Backport PR #​32230, Upstream PR #​32008, @​darox)
• Avoids drops with "No mapping for NAT masquerade" for ICMP messages by local service backends. (Backport PR #​32384, Upstream PR #​32155, @​julianwiedmann)
• cilium-cni: Reserve ports that can conflict with transparent DNS proxy (Backport PR #​32418, Upstream PR #​32128, @​gandro)
• cni: Use correct route MTU when ENI, Azure or Alibaba Cloud IPAM is enabled (Backport PR #​32384, Upstream PR #​32244, @​learnitall)
• dnsproxy: Fix bug where DNS request timed out too soon (Backport PR #​32230, Upstream PR #​31999, @​gandro)
• Envoy upstream connections are now unique for each downstream connection when using the original source address of a source pod. (Backport PR #​32312, Upstream PR #​32270, @​jrajahalme)
• envoy: pass idle timeout configuration option to cilium configmap (Backport PR #​32230, Upstream PR #​32203, @​mhofstetter)
• Fix failing service connections, when the service requests are transported via cilium's overlay network. (Backport PR #​32230, Upstream PR #​32116, @​julianwiedmann)
• Fix issue causing clustermesh-apiserver/kvstoremesh to not start when run with a non-root user (Backport PR #​31879, Upstream PR #​31539, @​giorio94)
• Fix service connection to terminating backend, when the service has no more backends available. (Backport PR #​32092, Upstream PR #​31840, @​julianwiedmann)
• Fix various bugs related to restart of StatefulSet pods that may result in connectivity issues (Backport PR #​32432, Upstream PR #​31605, @​christarazi)
• Fixes a bug where Cilium in chained mode removed the agent-not-ready taint too early if the primary network is slow in deploying. (Backport PR #​32230, Upstream PR #​32168, @​squeed)
• Fixes an (unlikely) bug where HostFirewall policies may miss updates to a node's labels. (Backport PR #​32384, Upstream PR #​30548, @​squeed)
• fqdn: fix memory leak in transparent mode when there was a moderately high number of parallel DNS requests (>100). (Backport PR #​32103, Upstream PR #​31959, @​marseel)
• Ingress/Gateway API: merge Envoy listeners for HTTP(S) and TLS passthrough (Backport PR #​32178, Upstream PR #​31646, @​mhofstetter)
• ipam: retry netlink.LinkList call when setting up ENI devices (Backport PR #​32230, Upstream PR #​32099, @​jasonaliyetti)
• loader: sanitize bpffs directory strings for netdevs (Backport PR #​32103, Upstream PR #​32090, @​rgo3)
• Prevent Cilium agents from incorrectly restarting an etcd watch against a different etcd instance. (#​32005, @​giorio94)
• tables: Sort node addresses also by public vs private IP (Backport PR #​32103, Upstream PR #​30579, @​joamaki)

CI Changes:

• alibabacloud/eni: avoid racing node mgr in test (Backport PR #​31967, Upstream PR #​31877, @​bimmlerd)
• ci: Filter supported versions of AKS (Backport PR #​32384, Upstream PR #​32303, @​marseel)
• ci: Increase timeout for images for l4lb test (Backport PR #​32230, Upstream PR #​32201, @​marseel)
• ci: Set hubble.relay.retryTimeout=5s (Backport PR #​32230, Upstream PR #​32066, @​chancez)
• enable kube cache mutation detector (Backport PR #​32230, Upstream PR #​32069, @​aanm)
• gha: bump post-upgrade timeout in clustermesh upgrade/downgrade tests (Backport PR #​32384, Upstream PR #​32347, @​giorio94)
• gha: configure fully-qualified DNS names as external targets (Backport PR #​32103, Upstream PR #​31510, @​giorio94)
• gha: drop double installation of Cilium CLI in conformance-eks (Backport PR #​32103, Upstream PR #​32042, @​giorio94)
• Miscellaneous improvements to the clustermesh upgrade/downgrade test (Backport PR #​32103, Upstream PR #​31958, @​giorio94)
• route: dedicated net ns for each subtest of runListRules (Backport PR #​32230, Upstream PR #​29916, @​mhofstetter)
• test: De-flake xds server_e2e_test (Backport PR #​32103, Upstream PR #​32004, @​jrajahalme)
• workflows: Fix CI jobs for push events on private forks (Backport PR #​32230, Upstream PR #​32085, @​pchaigno)

Misc Changes:

• bpf: host: simplify MARK_MAGIC_PROXY_EGRESS_EPID handling (Backport PR #​32384, Upstream PR #​29803, @​julianwiedmann)
• build(deps): bump pydantic from 2.3.0 to 2.4.0 in /Documentation (Backport PR #​32230, Upstream PR #​32176, @​dependabot[bot])
• chore(deps): update all github action dependencies (v1.15) (#​31954, @​renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​32107, @​renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​32366, @​renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​31993, @​renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​32238, @​renovate[bot])
• chore(deps): update azure/login action to v2.1.0 (v1.15) (#​31994, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.6 (v1.15) (#​32365, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.9 docker digest to 81811f8 (v1.15) (#​31953, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.9 docker digest to d83472f (v1.15) (#​32257, @​renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to a6d2b38 (v1.15) (#​32364, @​renovate[bot])
• chore(deps): update go to v1.21.10 (v1.15) (#​32417, @​renovate[bot])
• chore(deps): update golangci/golangci-lint-action action to v6 (v1.15) (#​32396, @​renovate[bot])
• chore(deps): update hubble cli to v0.13.3 (v1.15) (#​32108, @​renovate[bot])
• chore(deps): update stable lvh-images (v1.15) (patch) (#​31821, @​renovate[bot])
• CI: bump default FQDN datapath timeout from 100 to 250ms (Backport PR #​32230, Upstream PR #​31866, @​squeed)
• clustermesh: fix panic if the etcd client cannot be created (Backport PR #​32384, Upstream PR #​32225, @​giorio94)
• docs: Add annotation for Ingress endpoint (Backport PR #​32384, Upstream PR #​32284, @​sayboras)
• docs: add link to sig-policy meeting (Backport PR #​32384, Upstream PR #​32340, @​squeed)
• docs: Clean-up Host Firewall documentation, list known issues (Backport PR #​32384, Upstream PR #​32267, @​qmonnet)
• docs: Fix prometheus port regex (Backport PR #​32230, Upstream PR #​32030, @​JBodkin-Amphora)
• Docs: mark Tetragon as Stable (Backport PR #​31967, Upstream PR #​31886, @​sharlns)
• Document Cluster Mesh global services limitations when KPR=false (Backport PR #​31967, Upstream PR #​31798, @​giorio94)
• endpoint: Skip build queue warning log is context is canceled (Backport PR #​32230, Upstream PR #​32132, @​jrajahalme)
• Fix helm chart incompatible types for comparison (Backport PR #​32230, Upstream PR #​32025, @​lou-lan)
• fqdn: Change error log to warning (Backport PR #​32384, Upstream PR #​32333, @​jrajahalme)
• fqdn: Fix Upgrade Issue Between PortProto Versions (Backport PR #​32384, Upstream PR #​32325, @​nathanjsweet)
• golangci: Enable errorlint (Backport PR #​31783, Upstream PR #​31458, @​jrajahalme)
• images: Update bpftool, checkpatch images (Backport PR #​31896, Upstream PR #​31753, @​qmonnet)
• Improve release organization page (Backport PR #​32103, Upstream PR #​31970, @​joestringer)
• install/kubernetes: add AppArmor profile to Cilium Daemonset (Backport PR #​32384, Upstream PR #​32199, @​aanm)
• install/kubernetes: update nodeinit image to latest version (Backport PR #​32230, Upstream PR #​32181, @​tklauser)
• ipsec: Debug info for transient IPsec upgrade drops (Backport PR #​32384, Upstream PR #​32240, @​pchaigno)
• l7 policy: add possibility to configure Envoy proxy xff-num-trusted-hops (Backport PR #​32260, Upstream PR #​32200, @​mhofstetter)
• Remove aks-preview from AKS workflows (Backport PR #​32230, Upstream PR #​32118, @​marseel)
• Seamlessly downgrade bpf attachments from tcx to tc (Backport PR #​32337, Upstream PR #​32228, @​ti-mo)

Other Changes:

• [1.15] images: update cilium-{runtime,builder} (#​32444, @​nebril)
• [v1.15-backport] Introduce fromEgressProxyRule (#​31922, @​jschwinger233)
• [v1.15] cilium-dbg: remove section with unknown health status. (#​31905, @​tommyp1ckles)
• [v1.15] proxy: skip rule removal if address family is not supported (#​32007, @​rgo3)
• envoy: Bump envoy version to v1.27.5 (#​32077, @​sayboras)
• envoy: Update envoy 1.27.x to 1.28.3 (#​32149, @​sayboras)
• fix k8s versions tested in CI (#​31965, @​nbusseneau)
• install: Update image digests for v1.15.4 (#​31915, @​asauber)

v1.15.5

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.5@​sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40
quay.io/cilium/cilium:stable@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.5@​sha256:914549caf4376a844b5e7696019182dd2a655b89d6a3cad10f9d0f9821759fd7
quay.io/cilium/clustermesh-apiserver:stable@sha256:914549caf4376a844b5e7696019182dd2a655b89d6a3cad10f9d0f9821759fd7

docker-plugin

quay.io/cilium/docker-plugin:v1.15.5@​sha256:c301dc000eff2940a82fc51f4a937793fa3a7212d77000a5aa06ae6116032437
quay.io/cilium/docker-plugin:stable@sha256:c301dc000eff2940a82fc51f4a937793fa3a7212d77000a5aa06ae6116032437

hubble-relay

quay.io/cilium/hubble-relay:v1.15.5@​sha256:1d24b24e3477ccf9b5ad081827db635419c136a2bd84a3e60f37b26a38dd0781
quay.io/cilium/hubble-relay:stable@sha256:1d24b24e3477ccf9b5ad081827db635419c136a2bd84a3e60f37b26a38dd0781

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.5@​sha256:d76d45e308f23398b786f1f05504863759849046c20c741ebb64ad80613f8fd3
quay.io/cilium/operator-alibabacloud:stable@sha256:d76d45e308f23398b786f1f05504863759849046c20c741ebb64ad80613f8fd3

operator-aws

quay.io/cilium/operator-aws:v1.15.5@​sha256:f9c0eaea023ce5a75b3ed1fc4b783f390c5a3c7dc1507a2dc4dbc667b80d1bd9
quay.io/cilium/operator-aws:stable@sha256:f9c0eaea023ce5a75b3ed1fc4b783f390c5a3c7dc1507a2dc4dbc667b80d1bd9

operator-azure

quay.io/cilium/operator-azure:v1.15.5@​sha256:0a56f2cfdcdf13da21b7fdcc870e29fef82e71e599cd8dd74eb65c377e035522
quay.io/cilium/operator-azure:stable@sha256:0a56f2cfdcdf13da21b7fdcc870e29fef82e71e599cd8dd74eb65c377e035522

operator-generic

quay.io/cilium/operator-generic:v1.15.5@​sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8
quay.io/cilium/operator-generic:stable@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8

operator

quay.io/cilium/operator:v1.15.5@​sha256:6f480128aa3d3b2c50a8dfa0bd5bc5121e48b1ee0bbc8eec9cae72e904bf10c3
quay.io/cilium/operator:stable@sha256:6f480128aa3d3b2c50a8dfa0bd5bc5121e48b1ee0bbc8eec9cae72e904bf10c3

v1.15.4: 1.15.4

Compare Source

We are pleased to announce the release of Cilium v1.15.4.

This release includes the option to configure Node map size, additional detail when using cilium-dbg bpf metrics list, a fix to an issue with overlapping keys that may have affected the ability to recover from a full Service map, and performance improvements to the Connection Tracking implementation. Bugfixes include improved behavior for overlapping and restored DNS policies, a fix to a race condition in Service updates for L7 LB, and a fix to the retry logic in the cilium health controllers.

Security Advisories

This release addresses a security vulnerability. For more information, see GHSA-j654-3ccm-vfmm

Summary of Changes

Minor Changes:

• Add "node-map-max" to allow configuring nodemap size. (Backport PR #​31727, Upstream PR #​31407, @​tommyp1ckles)
• Add line numbers and file names to all metrics in 'cilium-dbg bpf metrics list' (Backport PR #​31558, Upstream PR #​30972, @​ti-mo)
• bugtool: Collect hubble metrics (Backport PR #​31890, Upstream PR #​31533, @​chancez)
• feat: Add the http return code to metric api_processed_total (Backport PR #​31890, Upstream PR #​31227, @​vipul-21)
• Fix overlapping keys in agent-side service BPF map cache used for retries. In rare cases this bug may have caused retrying of a failed BPF map update for a services entry to be skipped leading to a missing entry. This may have, for example, adversely affected recovering from a full BPF service map after excess services were removed. (Backport PR #​31890, Upstream PR #​29581, @​xyz-li)
• Skip overlay traffic in the BPF SNAT processing, and thus reduce pressure on the BPF Connection tracking and NAT maps. (Backport PR #​31785, Upstream PR #​31082, @​julianwiedmann)

Bugfixes:

• Avoid drops with "CT: Unknown L4 protocol" for non-ICMP/TCP/UDP traffic, caused by an error check in the BPF NAT engine. (Backport PR #​31890, Upstream PR #​31820, @​julianwiedmann)
• cilium-health: Fix broken retry loop in cilium-health-ep controller (Backport PR #​31727, Upstream PR #​31622, @​gandro)
• cni: Allow text-ts log format value (Backport PR #​31890, Upstream PR #​31686, @​sayboras)
• Fix a bug that could cause local packet delivery to be skipped, leading to lower performance, when IPsec was enabled and --devices provided. (Backport PR #​31601, Upstream PR #​31345, @​pchaigno)
• Fix incorrect reporting of the number of etcd lock leases in cilium-dbg status. (Backport PR #​31890, Upstream PR #​31781, @​giorio94)
• fix: Delegated ipam not configure ipv6 if ipv6 disabled in agent (Backport PR #​31727, Upstream PR #​31104, @​tamilmani1989)
• Fixed a race condition in service updates for L7 LB. (Backport PR #​31860, Upstream PR #​31744, @​jrajahalme)
• fqdn: Fix minor restore bug that causes false negative checks against a restored DNS IP map. (#​31870, @​nathanjsweet)
• fqdn: Fixed bug that caused DNS Proxy to be overly restrictive on allowed DNS selectors. (Backport PR #​31727, Upstream PR #​31328, @​nathanjsweet)
• gateway-api: Ensure hostname check when set on both the HTTPRoute and the Gateway Listener (Backport PR #​31769, Upstream PR #​30686, @​cjvirtucio87)
• gateway-api: fixed RequestRedirect picks wrong port with multiple listeners (Backport PR #​31769, Upstream PR #​31361, @​chaunceyjiang)
• gateway-api: shorten the length of the value of the svc's label. (Backport PR #​31769, Upstream PR #​31292, @​chaunceyjiang)
• ingress/gateway-api: sort virtual hosts in CEC (Backport PR #​31739, Upstream PR #​31493, @​mhofstetter)
• ingress/gateway-api: stable envoy listener filterchain sort-order (Backport PR #​31601, Upstream PR #​31572, @​mhofstetter)
• metric: Avoid memory leak/increase in cilium-agent (Backport PR #​31890, Upstream PR #​31714, @​sayboras)

CI Changes:

• ci-e2e: Add e2e test with WireGuard + Host Firewall (Backport PR #​31727, Upstream PR #​31594, @​qmonnet)
• ci/ipsec: Print more info to debug credentials removal check failures (Backport PR #​31727, Upstream PR #​31652, @​qmonnet)
• deflake endpointmanager tests (Backport PR #​31601, Upstream PR #​31488, @​bimmlerd)
• gh/workflows: Add IPsec key rotation action and use it in ci-eks / ci-ipsec-e2e (Backport PR #​31428, Upstream PR #​29704, @​brb)
• Make BPF unit tests reproducible (Backport PR #​31663, Upstream PR #​31526, @​ti-mo)
• Make testdata build output more stable by reducing header includes (Backport PR #​31663, Upstream PR #​31644, @​ti-mo)
• update azure k8s versions (Backport PR #​31890, Upstream PR #​31220, @​brlbil)
• workflows: Debug info for key rotations (Backport PR #​31727, Upstream PR #​31627, @​pchaigno)
• workflows: ipsec-e2e: add missing key types for some configs (Backport PR #​31727, Upstream PR #​31636, @​julianwiedmann)

Misc Changes:

• bitlpm: Document and Fix Descendants Bug (Backport PR #​31890, Upstream PR #​31851, @​nathanjsweet)
• bpf: host: restore HostFW for overlay traffic in to-netdev (Backport PR #​31785, Upstream PR #​31818, @​julianwiedmann)
• bpf: tests: don't define HAVE_ENCAP in IPsec tests (Backport PR #​31785, Upstream PR #​31737, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.15) (#​31822, @​renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​31698, @​renovate[bot])
• chore(deps): update cilium/little-vm-helper action to v0.0.17 (v1.15) (#​31703, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.4 (v1.15) (#​31674, @​renovate[bot])
• chore(deps): update docker/setup-buildx-action action to v3.3.0 (v1.15) (#​31828, @​renovate[bot])
• chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to f41b84c (v1.15) (#​31747, @​renovate[bot])
• chore(deps): update go to v1.21.9 (v1.15) (#​31764, @​renovate[bot])
• chore(deps): update stable lvh-images (v1.15) (patch) (#​31704, @​renovate[bot])
• cilium-dbg: avoid leaking file resources (Backport PR #​31890, Upstream PR #​31750, @​tklauser)
• docs: Document No node ID found drops in case of remote node deletion (Backport PR #​31727, Upstream PR #​31635, @​pchaigno)
• docs: ipsec: document native-routing + Egress proxy case (Backport PR #​31727, Upstream PR #​31478, @​julianwiedmann)
• Fix spelling in DNS-based proxy info (Backport PR #​31890, Upstream PR #​31728, @​saintdle)
• helm: update nodeinit image using renovate (Backport PR #​31727, Upstream PR #​31641, @​tklauser)
• ingress: sort all shared ingresses during model generation (Backport PR #​31727, Upstream PR #​31494, @​mhofstetter)
• loader: refactor/cleanup replaceNetworkDatapath (Backport PR #​31663, Upstream PR #​29825, @​rgo3)
• Move governance docs to the Cilium community repo (Backport PR #​31890, Upstream PR #​31692, @​katiestruthers)
• Remove Hubble-OTel from the roadmap (Backport PR #​31890, Upstream PR #​31847, @​xmulligan)
• Remove tcx links created by Cilium 1.16 onwards (Backport PR #​31663, Upstream PR #​31553, @​ti-mo)
• Restructure OpenShift installation instructions to point to Red Hat Ecosystem Catalog (Backport PR #​31727, Upstream PR #​29300, @​learnitall)
• v1.15: update cilium/certgen to v0.1.11 (#​31882, @​rolinh)

Other Changes:

• [v1.15] envoy: Bump envoy image for golang 1.21.9 (#​31770, @​sayboras)
• [v1.15] Multicast Datapath Backport (#​31668, @​ldelossa)
• [v1.15] route: Specify "proto kernel" for ip routes and rules (#​31777, @​jschwinger233)
• envoy: Bump envoy version to v1.27.4 (#​31807, @​sayboras)
• install: Update image digests for v1.15.3 (#​31623, @​jrajahalme)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.4@​sha256:b760a4831f5aab71c711f7537a107b751d0d0ce90dd32d8b358df3c5da385426
quay.io/cilium/cilium:stable@sha256:b760a4831f5aab71c711f7537a107b751d0d0ce90dd32d8b358df3c5da385426

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.4@​sha256:3fadf85d2aa0ecec09152e7e2d57648bda7e35bdc161b25ab54066dd4c3b299c
quay.io/cilium/clustermesh-apiserver:stable@sha256:3fadf85d2aa0ecec09152e7e2d57648bda7e35bdc161b25ab54066dd4c3b299c

docker-plugin

quay.io/cilium/docker-plugin:v1.15.4@​sha256:af22e26e927ec01633526b3d2fd5e15f2c7f3aab9d8c399081eeb746a4e0db47
quay.io/cilium/docker-plugin:stable@sha256:af22e26e927ec01633526b3d2fd5e15f2c7f3aab9d8c399081eeb746a4e0db47

hubble-relay

quay.io/cilium/hubble-relay:v1.15.4@​sha256:03ad857feaf52f1b4774c29614f42a50b370680eb7d0bfbc1ae065df84b1070a
quay.io/cilium/hubble-relay:stable@sha256:03ad857feaf52f1b4774c29614f42a50b370680eb7d0bfbc1ae065df84b1070a

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.4@​sha256:7c0e5346483a517e18a8951f4d4399337fb47020f2d9225e2ceaa8c5d9a45a5f
quay.io/cilium/operator-alibabacloud:stable@sha256:7c0e5346483a517e18a8951f4d4399337fb47020f2d9225e2ceaa8c5d9a45a5f

operator-aws

quay.io/cilium/operator-aws:v1.15.4@​sha256:8675486ce8938333390c37302af162ebd12aaebc08eeeaf383bfb73128143fa9
quay.io/cilium/operator-aws:stable@sha256:8675486ce8938333390c37302af162ebd12aaebc08eeeaf383bfb73128143fa9

operator-azure

quay.io/cilium/operator-azure:v1.15.4@​sha256:4c1a31502931681fa18a41ead2a3904b97d47172a92b7a7b205026bd1e715207
quay.io/cilium/operator-azure:stable@sha256:4c1a31502931681fa18a41ead2a3904b97d47172a92b7a7b205026bd1e715207

operator-generic

quay.io/cilium/operator-generic:v1.15.4@​sha256:404890a83cca3f28829eb7e54c1564bb6904708cdb7be04ebe69c2b60f164e9a
quay.io/cilium/operator-generic:stable@sha256:404890a83cca3f28829eb7e54c1564bb6904708cdb7be04ebe69c2b60f164e9a

operator

quay.io/cilium/operator:v1.15.4@​sha256:4e42b867d816808f10b38f555d6ae50065ebdc6ddc4549635f2fe50ed6dc8d7f
quay.io/cilium/operator:stable@sha256:4e42b867d816808f10b38f555d6ae50065ebdc6ddc4549635f2fe50ed6dc8d7f

v1.15.3: 1.15.3

Compare Source

We are pleased to release Cilium v1.15.3.

Security Advisories

This release addresses a security vulnerability. For more information, see GHSA-pwqm-x5x6-5586.

Summary of Changes

Minor Changes:

• bgpv1: BGP Control Plane metrics (Backport PR #​31568, Upstream PR #​31469, @​YutaroHayakawa)
• cni: use default logger with timestamps. (Backport PR #​31342, Upstream PR #​31014, @​tommyp1ckles)
• Introduce cilium-dbg encrypt flush --stale flag to remove XFRM states and policies with stale node IDs. (Backport PR #​31342, Upstream PR #​31159, @​pchaigno)

Bugfixes:

• [v1.15 - Author backport] envoy: enable k8s secret watch even if only CEC is enabled (#​31451, @​mhofstetter)
• cni: Use batch endpoint deletion API in chaining plugin (Backport PR #​31515, Upstream PR #​31456, @​sayboras)
• Fix a bug in the StateDB library that may have caused stale read after write. This may have potentially affected the L2 announcements feature and the node address selection. (Backport PR #​31342, Upstream PR #​31164, @​joamaki)
• Fix a bug where pod label updates are not reflected in endpoint labels in presence of filtered labels. (Backport PR #​31473, Upstream PR #​31395, @​tklauser)
• Fixed issue with assigning 0 nodeID when corresponding bpf map run out of space.
  Potentially it could have impacted connectivity in large clusters (>4k nodes) with IPSec or Mutual Auth enabled.
  Otherwise, it was merely generating unnecessary error log messages. (Backport PR #​31490, Upstream PR #​31380, @​marseel)
• gateway-api: Retrieve LB service from same namespace (Backport PR #​31490, Upstream PR #​31271, @​sayboras)
• Handle InvalidParameterValue as well for PD fallback (Backport PR #​31490, Upstream PR #​31016, @​hemanthmalla)
• helm: Update pod affinity for cilium-envoy (Backport PR #​31490, Upstream PR #​31150, @​sayboras)
• hubble/relay: Fix certificate reloading in PeerManager (Backport PR #​31568, Upstream PR #​31376, @​glrf)
• Hubble: fix traffic direction and is reply when IPSec is enabled (Backport PR #​31568, Upstream PR #​31211, @​kaworu)
• k8s/utils: correctly filter out labels in StripPodSpecialLabels (Backport PR #​31473, Upstream PR #​31421, @​tklauser)
• metrics: Disable prometheus metrics by default (Backport PR #​31342, Upstream PR #​31144, @​joestringer)
• operator: fix errors/warnings metric. (Backport PR #​31490, Upstream PR #​31214, @​tommyp1ckles)

CI Changes:

• [v1.15] test: Remove duplicate Cilium deployments in some datapath config tests (#​31520, @​qmonnet)
• Additionally test host firewall + KPR disabled in E2E tests (Backport PR #​31342, Upstream PR #​30914, @​giorio94)
• AKS: avoid overlapping pod and service CIDRs (Backport PR #​31568, Upstream PR #​31504, @​bimmlerd)
• bgpv1: avoid object tracker vs informer race (Backport PR #​31490, Upstream PR #​31010, @​bimmlerd)
• bgpv1: fix Test_PodIPPoolAdvert flakiness (Backport PR #​31490, Upstream PR #​31365, @​rastislavs)
• bpf: fix go testdata check in ci (Backport PR #​31554, Upstream PR #​31419, @​mhofstetter)
• Centralize configuration of kind version/image in GitHub Action workflows (Backport PR #​31191, Upstream PR #​30916, @​giorio94)
• Checkout the target branch, instead of the default one, on pull_request based GHA test workflows (Backport PR #​31191, Upstream PR #​31198, @​giorio94)
• ci-e2e: Add matrix for bpf.tproxy and ingress-controller (Backport PR #​31490, Upstream PR #​31272, @​sayboras)
• ci: Bump lvh-kind ssh-startup-wait-retries (Backport PR #​31490, Upstream PR #​31387, @​YutaroHayakawa)
• controlplane: fix mechanism for ensuring watchers (Backport PR #​31490, Upstream PR #​31030, @​bimmlerd)
• Fix bug preventing consistent symbols between ELF and BTF for eBPF unit tests. (Backport PR #​31342, Upstream PR #​30610, @​learnitall)
• gateway-api: Enable GRPCRoute conformance tests (Backport PR #​31342, Upstream PR #​31055, @​sayboras)
• gha: disable fail-fast on integration tests (Backport PR #​31490, Upstream PR #​31420, @​giorio94)
• gha: drop unused check_url environment variable (Backport PR #​31191, Upstream PR #​30928, @​giorio94)
• introduce ARM github workflows (Backport PR #​31342, Upstream PR #​31196, @​aanm)
• ipam: deepcopy interface resource correctly. (Backport PR #​31490, Upstream PR #​26998, @​tommyp1ckles)
• k8s_install.sh: specify the CNI version (Backport PR #​31342, Upstream PR #​31182, @​aanm)
• loader: fix issue where errors cancelled compile cause error logs. (Backport PR #​31342, Upstream PR #​30988, @​tommyp1ckles)
• Reduce flakiness of controlplane tests (Backport PR #​31490, Upstream PR #​30906, @​bimmlerd)
• slices: don't modify missed input slice in test (Backport PR #​31490, Upstream PR #​31119, @​bimmlerd)

Misc Changes:

• Add monitor aggregation for all events related to packets ingressing to the network-facing device. (Backport PR #​31342, Upstream PR #​31015, @​learnitall)
• Address race condition in TestGetIdentity (Backport PR #​31541, Upstream PR #​30885, @​bimmlerd)
• bgpv1: Adjust ConnectionRetryTimeSeconds to 1 in component tests (Backport PR #​31342, Upstream PR #​31218, @​YutaroHayakawa)
• chore(deps): update all github action dependencies (v1.15) (#​31480, @​renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​31582, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.3 (v1.15) (#​31464, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.8 docker digest to 8560736 (v1.15) (#​31450, @​renovate[bot])
• chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to 55c6361 (v1.15) (#​31453, @​renovate[bot])
• chore: update json-mock image source in examples (Backport PR #​31568, Upstream PR #​31373, @​loomkoom)
• cilium-dbg: listing load-balancing configurations displays L7LB proxy port (Backport PR #​31568, Upstream PR #​31503, @​mhofstetter)
• datapath, bpf: Remove unnecessary IPsec code (Backport PR #​31490, Upstream PR #​31344, @​pchaigno)
• doc: Clarified GwAPI KPR prerequisites (Backport PR #​31490, Upstream PR #​31366, @​PhilipSchmid)
• docs: Warn on key rotations during upgrades (Backport PR #​31490, Upstream PR #​31437, @​pchaigno)
• Don't emit an error message on namespace termination due to Ingress reconciliation (Backport PR #​31342, Upstream PR #​30808, @​giorio94)
• Downgrade L2 Neighbor Discovery failure log to Debug (Backport PR #​31342, Upstream PR #​31179, @​YutaroHayakawa)
• endpointmanager: Improve health reporter messages when stopped (Backport PR #​31342, Upstream PR #​31231, @​christarazi)
• hive/cell/health: don't warn when reporting on stopped reporter. (Backport PR #​31490, Upstream PR #​31262, @​tommyp1ckles)
• ingress: Update docs with network policy example (Backport PR #​31342, Upstream PR #​31060, @​sayboras)
• job: avoid a race condition in TestTimer_ExitOnCloseFnCtx (Backport PR #​31490, Upstream PR #​30929, @​bimmlerd)
• loader: add message if error is ENOTSUP (Backport PR #​31490, Upstream PR #​31413, @​kkourt)
• policy: Fix missing labels from SelectorCache selectors (Backport PR #​31490, Upstream PR #​31358, @​christarazi)
• Replaced declare_tailcall_if with logic in the loader (Backport PR #​31554, Upstream PR #​30467, @​dylandreimerink)

Other Changes:

• install: Update image digests for v1.15.2 (#​31378, @​jrajahalme)
• v1.15: IPsec Fixes (#​31610, @​pchaigno)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.