Prepare for release v1.16.2 #34973

cilium-release-bot · 2024-09-20T08:39:32Z

Summary of Changes

Minor Changes:

Add validation to prevent users from using deprecated values that have been removed in v1.15 and v1.16 (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR helm: Add validation to prevent users from using deprecated values that have been removed in v1.15 and v1.16 #34229, @chancez)
bgpv2: update status field of CiliumBGPNodeConfig CRD (Backport PR v1.16 Manual backport for BGPv2 state update #34580, Upstream PR bgpv2: Update status of CiliumBGPNodeConfig when gobgp state changes #33411, @harsimran-pabla)
docs: Update examples for CNP L7 Host (Backport PR v1.16 Backports 2024-09-02 #34644, Upstream PR docs: Update examples for CNP L7 Host #34578, @sayboras)
egressgw: drop traffic when gateway node is not configured for policy (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR egressgw: drop traffic when gateway node is not configured for policy #33625, @julianwiedmann)

Bugfixes:

add support for validation of stringToString values in ConfigMap (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR fix: support validation of stringToString values in ConfigMap #34279, @alex-berger)
bgpv2: correct service reconciler initialization (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR bgpv2: correct service reconciler initialization #34415, @harsimran-pabla)
bgpv2: fix cilium-dbg bgp filtering by ASN & route-policy dump format (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR bgpv2: fix cilium-dbg bgp filtering by ASN & route-policy dump format #34335, @rastislavs)
bpf: Fix Prune map operation leaking BPF map entries (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR bpf: Fix Prune map operation leaking BPF map entries #34476, @gandro)
config: fix disabling config 'Debug' (Backport PR [v1.16] author backport: config: fix disabling config 'Debug' #34469, Upstream PR config: fix disabling config 'Debug' #34401, @mhofstetter)
daemon: Create IPsec and LRP maps early on startup (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR daemon: Create IPsec and LRP maps early on startup #34388, @pchaigno)
daemon: Fix error logic flow for pod store being out of date (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR daemon: Fix error logic flow for pod store being out of date #34389, @christarazi)
envoy: fix log level mapping when changing log level via API (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR envoy: fix log level mapping when changing log level via API #34400, @mhofstetter)
Fix "invalid sysctl parameter" error when Cilium needs to modify a sysctl with capital letters in its name. (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR sysctl: allow uppercase letters #34298, @julianwiedmann)
Fix a bug in Cilium's kube-proxy replacement, where replies by a local backend are dropped with DROP_NO_FIB. (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR Revert "bpf: nodeport: don't track L2 addr for connection to local backend" #34303, @julianwiedmann)
Fix a race condition that would cause errors related to maps LB{4,6}_SKIP_MAP when loading programs. (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR Fix LB{4,6}_SKIP_MAP map creations #34453, @pchaigno)
Fix agent panic when IPsec is enabled but XFRM stats are not exposed by the kernel. (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR Fix panic in ipsec/xfrm_collector.go #34647, @chaunceyjiang)
Fix issue where a hostport service would be created on an incorrect node when cilium-agent is configured with disable-endpoint-crd (Backport PR v1.16 Backports 2024-09-02 #34644, Upstream PR pkg/k8s: fix hostport service created on incorrect node #34385, @haozhangami)
Fix operator deployment connecting to clustermesh kvstoremesh when endpointslice sync or MCS-API Service exports is enabled (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR helm: also mount kvstoremesh-specific certificate into cilium-operator #34295, @MrFreezeex)
Fix parsing of complex api-rate-limit options. The parsing failed when rate limits were configured for multiple API endpoints with multiple options, for example: "endpoint-create=rate-limit:1/s,rate-burst=1,endpoint-delete=rate-limit:2/s,rate-burst=2". The ability to also specify the rate limits as JSON strings was also returned. (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR daemon: Fix parsing of complex api-rate-limit arguments #34249, @joamaki)
Fix possible connection disruption on agent restart with WireGuard + native routing (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR wireguard: restore allowedIPs upon agent restart #34095, @giorio94)
Fix possible panic occurring in case errors are returned while updating/deleting IPv6 routes (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR route: fix LogAttrs panic if NextHop is nil #34721, @giorio94)
Fix the Egress Gateway reconciliation logic to make progress after setting the rp_filter sysctl failed. (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR egressgateway: proceeding following failure to update rp_filter. #34775, @julianwiedmann)
Fixes broken pod-to-remote-hostport connectivity when IPsec is used with L7 ingress policy and KPR. (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR bpf: Fix missing revDNAT when IPsec is used with L7 ingress policy and KPR #33805, @jschwinger233)
Fixes deadlock in identity watcher. This fixes an issue where a kvstore disconnect can cause the event receiver to exit and the event sender to get stuck forever. (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR Fix deadlock in identity watcher #34611, @dboslee)
helm: fix envoy prometheus metrics scraping with servicemonitor (Backport PR [v1.16] author backport: helm: fix envoy prometheus metrics scraping with servicemonitor #34472, Upstream PR helm: fix envoy prometheus metrics scraping with servicemonitor #34448, @mhofstetter)
ingress: Avoid opening of port 80 for TLSPassthrough only (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR ingress: Avoid opening of port 80 for TLSPassthrough only #34474, @sayboras)
ingress: Remove generated CEC if empty (Backport PR v1.16 Backports 2024-09-02 #34644, Upstream PR ingress: Remove generated CEC if empty #34576, @sayboras)
lbipam: fix panic when changing the shared key & req. ip annotation (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR lbipam: fix panic when changing the shared key & req. ip annotation #34236, @mhofstetter)
policy: Fixed CIDRGroupRef breaking the sanitization (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR policy: Fixed CIDRGroupRef breaking the sanitization #34076, @chaunceyjiang)
Replace dotted sysctl names with string slices (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR sysctl: Replace dotted names with string slices #34527, @dylandreimerink)

CI Changes:

.github: change nick-invision/retry -> nick-fields/retry. (.github: change nick-invision/retry -> nick-fields/retry. #34735, @michi-covalent)
bgpv1/test: fix route matching in PodIPPoolAdvert test (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR bgpv1/test: fix route matching in PodIPPoolAdvert test #34270, @rastislavs)
ci: clean disk only on ubuntu-latest runners (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR ci: clean disk only on ubuntu-latest runners #34711, @marseel)
ci: Confromance E2E wait for images before matrix generation (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR ci: Confromance E2E wait for images before matrix generation #34707, @marseel)
ci: datapath-verifier: also run on 6.6 kernel (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR ci: datapath-verifier: also run on 6.6 kernel #34420, @julianwiedmann)
ci: don't run AKS tests on LTS versions (Backport PR v1.16 Backports 2024-09-02 #34644, Upstream PR AKS ci: don't run LTS versions #34640, @marseel)
ci: Wait for images before generating test matrix (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR ci: Wait for images before generating test matrix #34727, @marseel)
Fix: push PR changes when renovate build images under the workflow_call context (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR fix: push PR changes out of pull request context #34650, @Artyop)
gha: Add disk cleanup step for build and test workflow (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR gha: Add disk cleanup step for build and test workflow #34339, @sayboras)

Misc Changes:

.github: remove installation steps for arm64 (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR .github: remove installation steps for arm64 #34336, @aanm)
[v1.16] deps: update Docker dependency ([v1.16] deps: update Docker dependency #34354, @ferozsalam)
bgpv2: correct error message log (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR bgpv2: correct error message log #34276, @harsimran-pabla)
chore(deps): update all github action dependencies (v1.16) (chore(deps): update all github action dependencies (v1.16) #34569, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (chore(deps): update all github action dependencies (v1.16) #34749, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (patch) (chore(deps): update all github action dependencies (v1.16) (patch) #34568, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (chore(deps): update all-dependencies (v1.16) #34687, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (chore(deps): update all-dependencies (v1.16) #34883, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.16.15 (v1.16) (chore(deps): update dependency cilium/cilium-cli to v0.16.15 (v1.16) #34118, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.16.16 (v1.16) (chore(deps): update dependency cilium/cilium-cli to v0.16.16 (v1.16) #34497, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.16.17 (v1.16) (chore(deps): update dependency cilium/cilium-cli to v0.16.17 (v1.16) #34878, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.36.1 docker digest to 34b191d (v1.16) (chore(deps): update docker.io/library/busybox:1.36.1 docker digest to 34b191d (v1.16) #34760, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.22.7 docker digest to 4594271 (v1.16) (chore(deps): update docker.io/library/golang:1.22.7 docker digest to 4594271 (v1.16) #34887, @cilium-renovate[bot])
chore(deps): update go to v1.22.7 (v1.16) (chore(deps): update go to v1.22.7 (v1.16) #34797, @cilium-renovate[bot])
chore: Avoid docker warning due to casing (Backport PR v1.16 Backports 2024-09-13 #34856, Upstream PR chore: Avoid docker warning due to casing #34125, @sayboras)
cilium-dbg: add Envoy admin commands (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR cilium-dbg: add Envoy admin commands #34398, @mhofstetter)
clustermesh/endpointslicesync: fix panic on failure in Test_meshEndpointSlice_Reconcile (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR clustermesh/endpointslicesync: fix panic on failure in Test_meshEndpointSlice_Reconcile #34699, @tklauser)
contrib: allow l7proxy in egressgw config (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR contrib: allow l7proxy in egressgw config #34636, @julianwiedmann)
docs: Avoid using wildcard TLS certificate (Backport PR v1.16 Backports 2024-09-11 #34831, Upstream PR docs: Avoid using wildcard TLS certificate #34609, @sayboras)
docs: Improve disk based policy documentation (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR docs: Improve disk based policy documentation #34234, @tamilmani1989)
docs: Update LB-IPAM allowFirstLastIPs documentation (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR docs: Update LB-IPAM allowFirstLastIPs documentation #34227, @dylandreimerink)
Documentation: Add instructions on accessing the Hubble API with TLS (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR Documentation: Add instructions on accessing the Hubble API with TLS #34361, @chancez)
Documentation: Add section to validate Hubble TLS is enabled (Backport PR v1.16 Backports 2024-09-02 #34644, Upstream PR Documentation: Add section to validate Hubble TLS is enabled #34416, @chancez)
endpoint: Do not pass a function to WithFields (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR endpoint: Do not pass a function to WithFields #34346, @jrajahalme)
fix: base image update workflow will now be triggered on renovate branches with a workflow_call event type (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR fix: base image workflow trigger conditional #34372, @Artyop)
images: fix path script (Backport PR [v1.16] images: fix path script and update base images #34768, Upstream PR images: fix path script #34764, @aanm)
ipsec: Document a new cause of XfrmInStateProtoError (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR ipsec: Document a new cause of XfrmInStateProtoError #34221, @jschwinger233)
pkg/endpointmanager: don't hold lock while iterating over subscribers (Backport PR v1.16 Backports 2024-08-27 #34586, Upstream PR pkg/endpointmanager: don't hold lock while iterating over subscribers #33896, @aanm)
Reorganize Hubble docs (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR Reorganize Hubble docs #34282, @chancez)
Use exponential backoff for etcd connection retries during quorum loss (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR Use exponential backoff for etcd connection retries during quorum loss #34231, @hemanthmalla)
wireguard: minor improvements (Backport PR v1.16 Backports 2024-08-19 #34452, Upstream PR wireguard: minor improvements #34285, @julianwiedmann)

Other Changes:

[v1.16] CODEOWNERS: switch cilium/tophat to cilium/committers ([v1.16] CODEOWNERS: switch cilium/tophat to cilium/committers #34338, @julianwiedmann)
[v1.16] envoy: Bump envoy version from v1.29.7 to v1.29.9 ([v1.16] envoy: Bump envoy version from v1.29.7 to v1.29.9 #34966, @sayboras)
[v1.16] envoy: Switch to image with timestamp tag ([v1.16] envoy: Switch to image with timestamp tag #34395, @sayboras)
envoy: Bump golang version (envoy: Bump golang version #34328, @sayboras)
Fix panic in endpoint regeneration when DNS requests are processed during early initialization. ([v1.16] loader: Wait for LocalNodeConfiguration to be set #34892, @joamaki)
install: Update image digests for v1.16.1 (install: Update image digests for v1.16.1 #34378, @cilium-release-bot[bot])

Signed-off-by: Cilium Release Bot <noreply@cilium.io>

Prepare for release v1.16.2

fd0ab14

Signed-off-by: Cilium Release Bot <noreply@cilium.io>

cilium-release-bot bot requested a review from a team as a code owner September 20, 2024 08:39

cilium-release-bot bot added kind/release Used for a PR that releases a new Cilium version. release-note/misc This PR makes changes that have no direct user impact. backport/1.16 This PR represents a backport for Cilium 1.16.x of a PR that was merged to main. labels Sep 20, 2024

maintainer-s-little-helper bot added the kind/backports This PR provides functionality previously merged into master. label Sep 20, 2024

nebril approved these changes Sep 20, 2024

View reviewed changes

aanm approved these changes Sep 20, 2024

View reviewed changes

nebril merged commit 3261be3 into v1.16 Sep 20, 2024
47 checks passed

nebril deleted the pr/prepare-v1.16.2 branch September 20, 2024 10:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Prepare for release v1.16.2 #34973

Prepare for release v1.16.2 #34973

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Prepare for release v1.16.2 #34973

Prepare for release v1.16.2 #34973

Uh oh!

Conversation

Summary of Changes

Uh oh!

Uh oh!

Uh oh!