chore(deps): update dependency cilium/cilium to v1.15.5

[renovate]

This PR contains the following updates:

Package	Update	Change
cilium/cilium	patch	1.15.1 -> 1.15.5

---

Release Notes

cilium/cilium (cilium/cilium)

v1.15.5: 1.15.5

Compare Source

We are pleased to announce the release of Cilium v1.15.5.

This release fixes a lot of bugs, including fixes for conflicting ports with DNS proxy, clustermesh startup issues, and StatefulSet handling.

Security Advisories

This release addresses following security vulnerabilities:

• GHSA-3mh5-6q8v-25wj
• GHSA-5fq7-4mxc-535h

Summary of Changes

Minor Changes:

• envoy: Bump go version to 1.22.3 (#​32413, @​sayboras)
• labels: Add controller-uid into default ignore list (Backport PR #​32103, Upstream PR #​31964, @​sayboras)

Bugfixes:

• Agent: add kubeconfigPath to initContainers (Backport PR #​32230, Upstream PR #​32008, @​darox)
• Avoids drops with "No mapping for NAT masquerade" for ICMP messages by local service backends. (Backport PR #​32384, Upstream PR #​32155, @​julianwiedmann)
• cilium-cni: Reserve ports that can conflict with transparent DNS proxy (Backport PR #​32418, Upstream PR #​32128, @​gandro)
• cni: Use correct route MTU when ENI, Azure or Alibaba Cloud IPAM is enabled (Backport PR #​32384, Upstream PR #​32244, @​learnitall)
• dnsproxy: Fix bug where DNS request timed out too soon (Backport PR #​32230, Upstream PR #​31999, @​gandro)
• Envoy upstream connections are now unique for each downstream connection when using the original source address of a source pod. (Backport PR #​32312, Upstream PR #​32270, @​jrajahalme)
• envoy: pass idle timeout configuration option to cilium configmap (Backport PR #​32230, Upstream PR #​32203, @​mhofstetter)
• Fix failing service connections, when the service requests are transported via cilium's overlay network. (Backport PR #​32230, Upstream PR #​32116, @​julianwiedmann)
• Fix issue causing clustermesh-apiserver/kvstoremesh to not start when run with a non-root user (Backport PR #​31879, Upstream PR #​31539, @​giorio94)
• Fix service connection to terminating backend, when the service has no more backends available. (Backport PR #​32092, Upstream PR #​31840, @​julianwiedmann)
• Fix various bugs related to restart of StatefulSet pods that may result in connectivity issues (Backport PR #​32432, Upstream PR #​31605, @​christarazi)
• Fixes a bug where Cilium in chained mode removed the agent-not-ready taint too early if the primary network is slow in deploying. (Backport PR #​32230, Upstream PR #​32168, @​squeed)
• Fixes an (unlikely) bug where HostFirewall policies may miss updates to a node's labels. (Backport PR #​32384, Upstream PR #​30548, @​squeed)
• fqdn: fix memory leak in transparent mode when there was a moderately high number of parallel DNS requests (>100). (Backport PR #​32103, Upstream PR #​31959, @​marseel)
• Ingress/Gateway API: merge Envoy listeners for HTTP(S) and TLS passthrough (Backport PR #​32178, Upstream PR #​31646, @​mhofstetter)
• ipam: retry netlink.LinkList call when setting up ENI devices (Backport PR #​32230, Upstream PR #​32099, @​jasonaliyetti)
• loader: sanitize bpffs directory strings for netdevs (Backport PR #​32103, Upstream PR #​32090, @​rgo3)
• Prevent Cilium agents from incorrectly restarting an etcd watch against a different etcd instance. (#​32005, @​giorio94)
• tables: Sort node addresses also by public vs private IP (Backport PR #​32103, Upstream PR #​30579, @​joamaki)

CI Changes:

• alibabacloud/eni: avoid racing node mgr in test (Backport PR #​31967, Upstream PR #​31877, @​bimmlerd)
• ci: Filter supported versions of AKS (Backport PR #​32384, Upstream PR #​32303, @​marseel)
• ci: Increase timeout for images for l4lb test (Backport PR #​32230, Upstream PR #​32201, @​marseel)
• ci: Set hubble.relay.retryTimeout=5s (Backport PR #​32230, Upstream PR #​32066, @​chancez)
• enable kube cache mutation detector (Backport PR #​32230, Upstream PR #​32069, @​aanm)
• gha: bump post-upgrade timeout in clustermesh upgrade/downgrade tests (Backport PR #​32384, Upstream PR #​32347, @​giorio94)
• gha: configure fully-qualified DNS names as external targets (Backport PR #​32103, Upstream PR #​31510, @​giorio94)
• gha: drop double installation of Cilium CLI in conformance-eks (Backport PR #​32103, Upstream PR #​32042, @​giorio94)
• Miscellaneous improvements to the clustermesh upgrade/downgrade test (Backport PR #​32103, Upstream PR #​31958, @​giorio94)
• route: dedicated net ns for each subtest of runListRules (Backport PR #​32230, Upstream PR #​29916, @​mhofstetter)
• test: De-flake xds server_e2e_test (Backport PR #​32103, Upstream PR #​32004, @​jrajahalme)
• workflows: Fix CI jobs for push events on private forks (Backport PR #​32230, Upstream PR #​32085, @​pchaigno)

Misc Changes:

• bpf: host: simplify MARK_MAGIC_PROXY_EGRESS_EPID handling (Backport PR #​32384, Upstream PR #​29803, @​julianwiedmann)
• build(deps): bump pydantic from 2.3.0 to 2.4.0 in /Documentation (Backport PR #​32230, Upstream PR #​32176, @​dependabot[bot])
• chore(deps): update all github action dependencies (v1.15) (#​31954, @​renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​32107, @​renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​32366, @​renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​31993, @​renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​32238, @​renovate[bot])
• chore(deps): update azure/login action to v2.1.0 (v1.15) (#​31994, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.6 (v1.15) (#​32365, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.9 docker digest to 81811f8 (v1.15) (#​31953, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.9 docker digest to d83472f (v1.15) (#​32257, @​renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to a6d2b38 (v1.15) (#​32364, @​renovate[bot])
• chore(deps): update go to v1.21.10 (v1.15) (#​32417, @​renovate[bot])
• chore(deps): update golangci/golangci-lint-action action to v6 (v1.15) (#​32396, @​renovate[bot])
• chore(deps): update hubble cli to v0.13.3 (v1.15) (#​32108, @​renovate[bot])
• chore(deps): update stable lvh-images (v1.15) (patch) (#​31821, @​renovate[bot])
• CI: bump default FQDN datapath timeout from 100 to 250ms (Backport PR #​32230, Upstream PR #​31866, @​squeed)
• clustermesh: fix panic if the etcd client cannot be created (Backport PR #​32384, Upstream PR #​32225, @​giorio94)
• docs: Add annotation for Ingress endpoint (Backport PR #​32384, Upstream PR #​32284, @​sayboras)
• docs: add link to sig-policy meeting (Backport PR #​32384, Upstream PR #​32340, @​squeed)
• docs: Clean-up Host Firewall documentation, list known issues (Backport PR #​32384, Upstream PR #​32267, @​qmonnet)
• docs: Fix prometheus port regex (Backport PR #​32230, Upstream PR #​32030, @​JBodkin-Amphora)
• Docs: mark Tetragon as Stable (Backport PR #​31967, Upstream PR #​31886, @​sharlns)
• Document Cluster Mesh global services limitations when KPR=false (Backport PR #​31967, Upstream PR #​31798, @​giorio94)
• endpoint: Skip build queue warning log is context is canceled (Backport PR #​32230, Upstream PR #​32132, @​jrajahalme)
• Fix helm chart incompatible types for comparison (Backport PR #​32230, Upstream PR #​32025, @​lou-lan)
• fqdn: Change error log to warning (Backport PR #​32384, Upstream PR #​32333, @​jrajahalme)
• fqdn: Fix Upgrade Issue Between PortProto Versions (Backport PR #​32384, Upstream PR #​32325, @​nathanjsweet)
• golangci: Enable errorlint (Backport PR #​31783, Upstream PR #​31458, @​jrajahalme)
• images: Update bpftool, checkpatch images (Backport PR #​31896, Upstream PR #​31753, @​qmonnet)
• Improve release organization page (Backport PR #​32103, Upstream PR #​31970, @​joestringer)
• install/kubernetes: add AppArmor profile to Cilium Daemonset (Backport PR #​32384, Upstream PR #​32199, @​aanm)
• install/kubernetes: update nodeinit image to latest version (Backport PR #​32230, Upstream PR #​32181, @​tklauser)
• ipsec: Debug info for transient IPsec upgrade drops (Backport PR #​32384, Upstream PR #​32240, @​pchaigno)
• l7 policy: add possibility to configure Envoy proxy xff-num-trusted-hops (Backport PR #​32260, Upstream PR #​32200, @​mhofstetter)
• Remove aks-preview from AKS workflows (Backport PR #​32230, Upstream PR #​32118, @​marseel)
• Seamlessly downgrade bpf attachments from tcx to tc (Backport PR #​32337, Upstream PR #​32228, @​ti-mo)

Other Changes:

• [1.15] images: update cilium-{runtime,builder} (#​32444, @​nebril)
• [v1.15-backport] Introduce fromEgressProxyRule (#​31922, @​jschwinger233)
• [v1.15] cilium-dbg: remove section with unknown health status. (#​31905, @​tommyp1ckles)
• [v1.15] proxy: skip rule removal if address family is not supported (#​32007, @​rgo3)
• envoy: Bump envoy version to v1.27.5 (#​32077, @​sayboras)
• envoy: Update envoy 1.27.x to 1.28.3 (#​32149, @​sayboras)
• fix k8s versions tested in CI (#​31965, @​nbusseneau)
• install: Update image digests for v1.15.4 (#​31915, @​asauber)

v1.15.5

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.5@​sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40
quay.io/cilium/cilium:stable@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.5@​sha256:914549caf4376a844b5e7696019182dd2a655b89d6a3cad10f9d0f9821759fd7
quay.io/cilium/clustermesh-apiserver:stable@sha256:914549caf4376a844b5e7696019182dd2a655b89d6a3cad10f9d0f9821759fd7

docker-plugin

quay.io/cilium/docker-plugin:v1.15.5@​sha256:c301dc000eff2940a82fc51f4a937793fa3a7212d77000a5aa06ae6116032437
quay.io/cilium/docker-plugin:stable@sha256:c301dc000eff2940a82fc51f4a937793fa3a7212d77000a5aa06ae6116032437

hubble-relay

quay.io/cilium/hubble-relay:v1.15.5@​sha256:1d24b24e3477ccf9b5ad081827db635419c136a2bd84a3e60f37b26a38dd0781
quay.io/cilium/hubble-relay:stable@sha256:1d24b24e3477ccf9b5ad081827db635419c136a2bd84a3e60f37b26a38dd0781

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.5@​sha256:d76d45e308f23398b786f1f05504863759849046c20c741ebb64ad80613f8fd3
quay.io/cilium/operator-alibabacloud:stable@sha256:d76d45e308f23398b786f1f05504863759849046c20c741ebb64ad80613f8fd3

operator-aws

quay.io/cilium/operator-aws:v1.15.5@​sha256:f9c0eaea023ce5a75b3ed1fc4b783f390c5a3c7dc1507a2dc4dbc667b80d1bd9
quay.io/cilium/operator-aws:stable@sha256:f9c0eaea023ce5a75b3ed1fc4b783f390c5a3c7dc1507a2dc4dbc667b80d1bd9

operator-azure

quay.io/cilium/operator-azure:v1.15.5@​sha256:0a56f2cfdcdf13da21b7fdcc870e29fef82e71e599cd8dd74eb65c377e035522
quay.io/cilium/operator-azure:stable@sha256:0a56f2cfdcdf13da21b7fdcc870e29fef82e71e599cd8dd74eb65c377e035522

operator-generic

quay.io/cilium/operator-generic:v1.15.5@​sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8
quay.io/cilium/operator-generic:stable@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8

operator

quay.io/cilium/operator:v1.15.5@​sha256:6f480128aa3d3b2c50a8dfa0bd5bc5121e48b1ee0bbc8eec9cae72e904bf10c3
quay.io/cilium/operator:stable@sha256:6f480128aa3d3b2c50a8dfa0bd5bc5121e48b1ee0bbc8eec9cae72e904bf10c3

v1.15.4: 1.15.4

Compare Source

We are pleased to announce the release of Cilium v1.15.4.

This release includes the option to configure Node map size, additional detail when using cilium-dbg bpf metrics list, a fix to an issue with overlapping keys that may have affected the ability to recover from a full Service map, and performance improvements to the Connection Tracking implementation. Bugfixes include improved behavior for overlapping and restored DNS policies, a fix to a race condition in Service updates for L7 LB, and a fix to the retry logic in the cilium health controllers.

Security Advisories

This release addresses a security vulnerability. For more information, see GHSA-j654-3ccm-vfmm

Summary of Changes

Minor Changes:

• Add "node-map-max" to allow configuring nodemap size. (Backport PR #​31727, Upstream PR #​31407, @​tommyp1ckles)
• Add line numbers and file names to all metrics in 'cilium-dbg bpf metrics list' (Backport PR #​31558, Upstream PR #​30972, @​ti-mo)
• bugtool: Collect hubble metrics (Backport PR #​31890, Upstream PR #​31533, @​chancez)
• feat: Add the http return code to metric api_processed_total (Backport PR #​31890, Upstream PR #​31227, @​vipul-21)
• Fix overlapping keys in agent-side service BPF map cache used for retries. In rare cases this bug may have caused retrying of a failed BPF map update for a services entry to be skipped leading to a missing entry. This may have, for example, adversely affected recovering from a full BPF service map after excess services were removed. (Backport PR #​31890, Upstream PR #​29581, @​xyz-li)
• Skip overlay traffic in the BPF SNAT processing, and thus reduce pressure on the BPF Connection tracking and NAT maps. (Backport PR #​31785, Upstream PR #​31082, @​julianwiedmann)

Bugfixes:

• Avoid drops with "CT: Unknown L4 protocol" for non-ICMP/TCP/UDP traffic, caused by an error check in the BPF NAT engine. (Backport PR #​31890, Upstream PR #​31820, @​julianwiedmann)
• cilium-health: Fix broken retry loop in cilium-health-ep controller (Backport PR #​31727, Upstream PR #​31622, @​gandro)
• cni: Allow text-ts log format value (Backport PR #​31890, Upstream PR #​31686, @​sayboras)
• Fix a bug that could cause local packet delivery to be skipped, leading to lower performance, when IPsec was enabled and --devices provided. (Backport PR #​31601, Upstream PR #​31345, @​pchaigno)
• Fix incorrect reporting of the number of etcd lock leases in cilium-dbg status. (Backport PR #​31890, Upstream PR #​31781, @​giorio94)
• fix: Delegated ipam not configure ipv6 if ipv6 disabled in agent (Backport PR #​31727, Upstream PR #​31104, @​tamilmani1989)
• Fixed a race condition in service updates for L7 LB. (Backport PR #​31860, Upstream PR #​31744, @​jrajahalme)
• fqdn: Fix minor restore bug that causes false negative checks against a restored DNS IP map. (#​31870, @​nathanjsweet)
• fqdn: Fixed bug that caused DNS Proxy to be overly restrictive on allowed DNS selectors. (Backport PR #​31727, Upstream PR #​31328, @​nathanjsweet)
• gateway-api: Ensure hostname check when set on both the HTTPRoute and the Gateway Listener (Backport PR #​31769, Upstream PR #​30686, @​cjvirtucio87)
• gateway-api: fixed RequestRedirect picks wrong port with multiple listeners (Backport PR #​31769, Upstream PR #​31361, @​chaunceyjiang)
• gateway-api: shorten the length of the value of the svc's label. (Backport PR #​31769, Upstream PR #​31292, @​chaunceyjiang)
• ingress/gateway-api: sort virtual hosts in CEC (Backport PR #​31739, Upstream PR #​31493, @​mhofstetter)
• ingress/gateway-api: stable envoy listener filterchain sort-order (Backport PR #​31601, Upstream PR #​31572, @​mhofstetter)
• metric: Avoid memory leak/increase in cilium-agent (Backport PR #​31890, Upstream PR #​31714, @​sayboras)

CI Changes:

• ci-e2e: Add e2e test with WireGuard + Host Firewall (Backport PR #​31727, Upstream PR #​31594, @​qmonnet)
• ci/ipsec: Print more info to debug credentials removal check failures (Backport PR #​31727, Upstream PR #​31652, @​qmonnet)
• deflake endpointmanager tests (Backport PR #​31601, Upstream PR #​31488, @​bimmlerd)
• gh/workflows: Add IPsec key rotation action and use it in ci-eks / ci-ipsec-e2e (Backport PR #​31428, Upstream PR #​29704, @​brb)
• Make BPF unit tests reproducible (Backport PR #​31663, Upstream PR #​31526, @​ti-mo)
• Make testdata build output more stable by reducing header includes (Backport PR #​31663, Upstream PR #​31644, @​ti-mo)
• update azure k8s versions (Backport PR #​31890, Upstream PR #​31220, @​brlbil)
• workflows: Debug info for key rotations (Backport PR #​31727, Upstream PR #​31627, @​pchaigno)
• workflows: ipsec-e2e: add missing key types for some configs (Backport PR #​31727, Upstream PR #​31636, @​julianwiedmann)

Misc Changes:

• bitlpm: Document and Fix Descendants Bug (Backport PR #​31890, Upstream PR #​31851, @​nathanjsweet)
• bpf: host: restore HostFW for overlay traffic in to-netdev (Backport PR #​31785, Upstream PR #​31818, @​julianwiedmann)
• bpf: tests: don't define HAVE_ENCAP in IPsec tests (Backport PR #​31785, Upstream PR #​31737, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.15) (#​31822, @​renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​31698, @​renovate[bot])
• chore(deps): update cilium/little-vm-helper action to v0.0.17 (v1.15) (#​31703, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.4 (v1.15) (#​31674, @​renovate[bot])
• chore(deps): update docker/setup-buildx-action action to v3.3.0 (v1.15) (#​31828, @​renovate[bot])
• chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to f41b84c (v1.15) (#​31747, @​renovate[bot])
• chore(deps): update go to v1.21.9 (v1.15) (#​31764, @​renovate[bot])
• chore(deps): update stable lvh-images (v1.15) (patch) (#​31704, @​renovate[bot])
• cilium-dbg: avoid leaking file resources (Backport PR #​31890, Upstream PR #​31750, @​tklauser)
• docs: Document No node ID found drops in case of remote node deletion (Backport PR #​31727, Upstream PR #​31635, @​pchaigno)
• docs: ipsec: document native-routing + Egress proxy case (Backport PR #​31727, Upstream PR #​31478, @​julianwiedmann)
• Fix spelling in DNS-based proxy info (Backport PR #​31890, Upstream PR #​31728, @​saintdle)
• helm: update nodeinit image using renovate (Backport PR #​31727, Upstream PR #​31641, @​tklauser)
• ingress: sort all shared ingresses during model generation (Backport PR #​31727, Upstream PR #​31494, @​mhofstetter)
• loader: refactor/cleanup replaceNetworkDatapath (Backport PR #​31663, Upstream PR #​29825, @​rgo3)
• Move governance docs to the Cilium community repo (Backport PR #​31890, Upstream PR #​31692, @​katiestruthers)
• Remove Hubble-OTel from the roadmap (Backport PR #​31890, Upstream PR #​31847, @​xmulligan)
• Remove tcx links created by Cilium 1.16 onwards (Backport PR #​31663, Upstream PR #​31553, @​ti-mo)
• Restructure OpenShift installation instructions to point to Red Hat Ecosystem Catalog (Backport PR #​31727, Upstream PR #​29300, @​learnitall)
• v1.15: update cilium/certgen to v0.1.11 (#​31882, @​rolinh)

Other Changes:

• [v1.15] envoy: Bump envoy image for golang 1.21.9 (#​31770, @​sayboras)
• [v1.15] Multicast Datapath Backport (#​31668, @​ldelossa)
• [v1.15] route: Specify "proto kernel" for ip routes and rules (#​31777, @​jschwinger233)
• envoy: Bump envoy version to v1.27.4 (#​31807, @​sayboras)
• install: Update image digests for v1.15.3 (#​31623, @​jrajahalme)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.4@​sha256:b760a4831f5aab71c711f7537a107b751d0d0ce90dd32d8b358df3c5da385426
quay.io/cilium/cilium:stable@sha256:b760a4831f5aab71c711f7537a107b751d0d0ce90dd32d8b358df3c5da385426

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.4@​sha256:3fadf85d2aa0ecec09152e7e2d57648bda7e35bdc161b25ab54066dd4c3b299c
quay.io/cilium/clustermesh-apiserver:stable@sha256:3fadf85d2aa0ecec09152e7e2d57648bda7e35bdc161b25ab54066dd4c3b299c

docker-plugin

quay.io/cilium/docker-plugin:v1.15.4@​sha256:af22e26e927ec01633526b3d2fd5e15f2c7f3aab9d8c399081eeb746a4e0db47
quay.io/cilium/docker-plugin:stable@sha256:af22e26e927ec01633526b3d2fd5e15f2c7f3aab9d8c399081eeb746a4e0db47

hubble-relay

quay.io/cilium/hubble-relay:v1.15.4@​sha256:03ad857feaf52f1b4774c29614f42a50b370680eb7d0bfbc1ae065df84b1070a
quay.io/cilium/hubble-relay:stable@sha256:03ad857feaf52f1b4774c29614f42a50b370680eb7d0bfbc1ae065df84b1070a

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.4@​sha256:7c0e5346483a517e18a8951f4d4399337fb47020f2d9225e2ceaa8c5d9a45a5f
quay.io/cilium/operator-alibabacloud:stable@sha256:7c0e5346483a517e18a8951f4d4399337fb47020f2d9225e2ceaa8c5d9a45a5f

operator-aws

quay.io/cilium/operator-aws:v1.15.4@​sha256:8675486ce8938333390c37302af162ebd12aaebc08eeeaf383bfb73128143fa9
quay.io/cilium/operator-aws:stable@sha256:8675486ce8938333390c37302af162ebd12aaebc08eeeaf383bfb73128143fa9

operator-azure

quay.io/cilium/operator-azure:v1.15.4@​sha256:4c1a31502931681fa18a41ead2a3904b97d47172a92b7a7b205026bd1e715207
quay.io/cilium/operator-azure:stable@sha256:4c1a31502931681fa18a41ead2a3904b97d47172a92b7a7b205026bd1e715207

operator-generic

quay.io/cilium/operator-generic:v1.15.4@​sha256:404890a83cca3f28829eb7e54c1564bb6904708cdb7be04ebe69c2b60f164e9a
quay.io/cilium/operator-generic:stable@sha256:404890a83cca3f28829eb7e54c1564bb6904708cdb7be04ebe69c2b60f164e9a

operator

quay.io/cilium/operator:v1.15.4@​sha256:4e42b867d816808f10b38f555d6ae50065ebdc6ddc4549635f2fe50ed6dc8d7f
quay.io/cilium/operator:stable@sha256:4e42b867d816808f10b38f555d6ae50065ebdc6ddc4549635f2fe50ed6dc8d7f

v1.15.3: 1.15.3

Compare Source

We are pleased to release Cilium v1.15.3.

Security Advisories

This release addresses a security vulnerability. For more information, see GHSA-pwqm-x5x6-5586.

Summary of Changes

Minor Changes:

• bgpv1: BGP Control Plane metrics (Backport PR #​31568, Upstream PR #​31469, @​YutaroHayakawa)
• cni: use default logger with timestamps. (Backport PR #​31342, Upstream PR #​31014, @​tommyp1ckles)
• Introduce cilium-dbg encrypt flush --stale flag to remove XFRM states and policies with stale node IDs. (Backport PR #​31342, Upstream PR #​31159, @​pchaigno)

Bugfixes:

• [v1.15 - Author backport] envoy: enable k8s secret watch even if only CEC is enabled (#​31451, @​mhofstetter)
• cni: Use batch endpoint deletion API in chaining plugin (Backport PR #​31515, Upstream PR #​31456, @​sayboras)
• Fix a bug in the StateDB library that may have caused stale read after write. This may have potentially affected the L2 announcements feature and the node address selection. (Backport PR #​31342, Upstream PR #​31164, @​joamaki)
• Fix a bug where pod label updates are not reflected in endpoint labels in presence of filtered labels. (Backport PR #​31473, Upstream PR #​31395, @​tklauser)
• Fixed issue with assigning 0 nodeID when corresponding bpf map run out of space.
  Potentially it could have impacted connectivity in large clusters (>4k nodes) with IPSec or Mutual Auth enabled.
  Otherwise, it was merely generating unnecessary error log messages. (Backport PR #​31490, Upstream PR #​31380, @​marseel)
• gateway-api: Retrieve LB service from same namespace (Backport PR #​31490, Upstream PR #​31271, @​sayboras)
• Handle InvalidParameterValue as well for PD fallback (Backport PR #​31490, Upstream PR #​31016, @​hemanthmalla)
• helm: Update pod affinity for cilium-envoy (Backport PR #​31490, Upstream PR #​31150, @​sayboras)
• hubble/relay: Fix certificate reloading in PeerManager (Backport PR #​31568, Upstream PR #​31376, @​glrf)
• Hubble: fix traffic direction and is reply when IPSec is enabled (Backport PR #​31568, Upstream PR #​31211, @​kaworu)
• k8s/utils: correctly filter out labels in StripPodSpecialLabels (Backport PR #​31473, Upstream PR #​31421, @​tklauser)
• metrics: Disable prometheus metrics by default (Backport PR #​31342, Upstream PR #​31144, @​joestringer)
• operator: fix errors/warnings metric. (Backport PR #​31490, Upstream PR #​31214, @​tommyp1ckles)

CI Changes:

• [v1.15] test: Remove duplicate Cilium deployments in some datapath config tests (#​31520, @​qmonnet)
• Additionally test host firewall + KPR disabled in E2E tests (Backport PR #​31342, Upstream PR #​30914, @​giorio94)
• AKS: avoid overlapping pod and service CIDRs (Backport PR #​31568, Upstream PR #​31504, @​bimmlerd)
• bgpv1: avoid object tracker vs informer race (Backport PR #​31490, Upstream PR #​31010, @​bimmlerd)
• bgpv1: fix Test_PodIPPoolAdvert flakiness (Backport PR #​31490, Upstream PR #​31365, @​rastislavs)
• bpf: fix go testdata check in ci (Backport PR #​31554, Upstream PR #​31419, @​mhofstetter)
• Centralize configuration of kind version/image in GitHub Action workflows (Backport PR #​31191, Upstream PR #​30916, @​giorio94)
• Checkout the target branch, instead of the default one, on pull_request based GHA test workflows (Backport PR #​31191, Upstream PR #​31198, @​giorio94)
• ci-e2e: Add matrix for bpf.tproxy and ingress-controller (Backport PR #​31490, Upstream PR #​31272, @​sayboras)
• ci: Bump lvh-kind ssh-startup-wait-retries (Backport PR #​31490, Upstream PR #​31387, @​YutaroHayakawa)
• controlplane: fix mechanism for ensuring watchers (Backport PR #​31490, Upstream PR #​31030, @​bimmlerd)
• Fix bug preventing consistent symbols between ELF and BTF for eBPF unit tests. (Backport PR #​31342, Upstream PR #​30610, @​learnitall)
• gateway-api: Enable GRPCRoute conformance tests (Backport PR #​31342, Upstream PR #​31055, @​sayboras)
• gha: disable fail-fast on integration tests (Backport PR #​31490, Upstream PR #​31420, @​giorio94)
• gha: drop unused check_url environment variable (Backport PR #​31191, Upstream PR #​30928, @​giorio94)
• introduce ARM github workflows (Backport PR #​31342, Upstream PR #​31196, @​aanm)
• ipam: deepcopy interface resource correctly. (Backport PR #​31490, Upstream PR #​26998, @​tommyp1ckles)
• k8s_install.sh: specify the CNI version (Backport PR #​31342, Upstream PR #​31182, @​aanm)
• loader: fix issue where errors cancelled compile cause error logs. (Backport PR #​31342, Upstream PR #​30988, @​tommyp1ckles)
• Reduce flakiness of controlplane tests (Backport PR #​31490, Upstream PR #​30906, @​bimmlerd)
• slices: don't modify missed input slice in test (Backport PR #​31490, Upstream PR #​31119, @​bimmlerd)

Misc Changes:

• Add monitor aggregation for all events related to packets ingressing to the network-facing device. (Backport PR #​31342, Upstream PR #​31015, @​learnitall)
• Address race condition in TestGetIdentity (Backport PR #​31541, Upstream PR #​30885, @​bimmlerd)
• bgpv1: Adjust ConnectionRetryTimeSeconds to 1 in component tests (Backport PR #​31342, Upstream PR #​31218, @​YutaroHayakawa)
• chore(deps): update all github action dependencies (v1.15) (#​31480, @​renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​31582, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.3 (v1.15) (#​31464, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.8 docker digest to 8560736 (v1.15) (#​31450, @​renovate[bot])
• chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to 55c6361 (v1.15) (#​31453, @​renovate[bot])
• chore: update json-mock image source in examples (Backport PR #​31568, Upstream PR #​31373, @​loomkoom)
• cilium-dbg: listing load-balancing configurations displays L7LB proxy port (Backport PR #​31568, Upstream PR #​31503, @​mhofstetter)
• datapath, bpf: Remove unnecessary IPsec code (Backport PR #​31490, Upstream PR #​31344, @​pchaigno)
• doc: Clarified GwAPI KPR prerequisites (Backport PR #​31490, Upstream PR #​31366, @​PhilipSchmid)
• docs: Warn on key rotations during upgrades (Backport PR #​31490, Upstream PR #​31437, @​pchaigno)
• Don't emit an error message on namespace termination due to Ingress reconciliation (Backport PR #​31342, Upstream PR #​30808, @​giorio94)
• Downgrade L2 Neighbor Discovery failure log to Debug (Backport PR #​31342, Upstream PR #​31179, @​YutaroHayakawa)
• endpointmanager: Improve health reporter messages when stopped (Backport PR #​31342, Upstream PR #​31231, @​christarazi)
• hive/cell/health: don't warn when reporting on stopped reporter. (Backport PR #​31490, Upstream PR #​31262, @​tommyp1ckles)
• ingress: Update docs with network policy example (Backport PR #​31342, Upstream PR #​31060, @​sayboras)
• job: avoid a race condition in TestTimer_ExitOnCloseFnCtx (Backport PR #​31490, Upstream PR #​30929, @​bimmlerd)
• loader: add message if error is ENOTSUP (Backport PR #​31490, Upstream PR #​31413, @​kkourt)
• policy: Fix missing labels from SelectorCache selectors (Backport PR #​31490, Upstream PR #​31358, @​christarazi)
• Replaced declare_tailcall_if with logic in the loader (Backport PR #​31554, Upstream PR #​30467, @​dylandreimerink)

Other Changes:

• install: Update image digests for v1.15.2 (#​31378, @​jrajahalme)
• v1.15: IPsec Fixes (#​31610, @​pchaigno)

v1.15.2: 1.15.2

Compare Source

We are pleased to release Cilium v1.15.2. This release contains various bug fixes and improvements.

Security Advisories

This patch release addresses security vulnerabilities. See the following security advisories
for details.

• GHSA-68mj-9pjq-mc85
• GHSA-j89h-qrvr-xc36
• GHSA-v6q2-4qr3-5cw6

IPsec

This patch release includes significant changes for the IPsec stack, to resolve issues for connections that are selected by a L7 Network Policy or a DNS Policy.

Such connections may experience disruption during the upgrade, in particular in configurations with overlay routing mode.

Summary of Changes

Minor Changes:

• Add default divisor for GOMEMLIMIT to satisfy Argo CD diff (Backport PR #​30997, Upstream PR #​30635, @​jdmcmahan)
• Fixes a bug where ToFQDN IPs may be garbage collected too early, disrupting existing connections. (Backport PR [#​31318](https://togithub.com/cilium/cilium/issues/31

---

Configuration

📅 Schedule: Branch creation - "on monday and friday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.