tobru/gitops-zurrli

Fork 0

Update Helm release cilium to v1.13.3 #171

Merged

tobru merged 1 commit from renovate/cilium-1.x into main

2023-05-30 12:09:55 +00:00

renovate-bot commented

2023-05-30 12:08:40 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.13.2` -> `1.13.3`

Release Notes

cilium/cilium

`v1.13.3`: 1.13.3

Compare Source

We are pleased to release Cilium v1.13.3. This release fixes bugs in ipsec and policy implementations and is recommended for all users.

Summary of Changes

Major Changes:

Assume Ingress identity for cluster internal traffic through Cilium Ingress for policy enforcement. (Backport PR #25019, Upstream PR #24826, @jrajahalme)
policy: Promote Deny Policies from Beta to Stable (#25427, @nathanjsweet)

Minor Changes:

Drop traffic matching an egress gateway policy when no gateway are found (Backport PR #24999, Upstream PR #24835, @MrFreezeex)
ingress: Add ownerReferences for shared mode (Backport PR #25013, Upstream PR #24942, @sayboras)
sysdump: Added Kubernetes CNI logs to sysdump. (Backport PR #25346, Upstream PR #23937, @marseel)
Update CNI (loopback) to 1.3.0 (Backport PR #25454, Upstream PR #25400, @anfernee)
Use BGP Control Plane annotations from Node Resource for creation of CiliumNode Resource (Backport PR #25346, Upstream PR #24914, @margau)

Bugfixes:

Add support for builtin kernel modules (Backport PR #25137, Upstream PR #23953, @TheAifam5)
Address cilium-agent startup performance regression. (Backport PR #25185, Upstream PR #25007, @bimmlerd)
cmd/cleanup: Fix cleanup of generic XDP programs (Backport PR #25184, Upstream PR #25117, @pchaigno)
datapath: Fix double SNAT (Backport PR #25223, Upstream PR #25189, @brb)
DNS proxy now always updates the proxy policy to avoid intermittent policy drops. (Backport PR #25346, Upstream PR #25147, @jrajahalme)
Filter ipv6 advertisements when using metallb as BGP speaker. (Backport PR #25137, Upstream PR #25043, @harsimran-pabla)
Fix a regression in which link-local addresses were not treated with the "host" identity in some circumstances. (Backport PR #25368, Upstream PR #25298, @asauber)
Fix broken IPv4 connectivity from outside to NodePort service when using L7 ingress policy, by removing PROXY_RT route table. (Backport PR #25086, Upstream PR #24807, @jschwinger233)
Fix bug that caused ToCIDR netpols matching kube-apiserver IPs (when external to the cluster) to not reliably allow connectivity. (#25241, @giorio94)
Fix bug that causes enforcement of host policies on reply IPv6 pod traffic. (Backport PR #25137, Upstream PR #25024, @pchaigno)
Fix bug where Cilium configurations running with tunneling disabled, BPF-masq disabled, but with masquerading enabled, do not clean up ipset configuration when a node IP changes. This can lead to a lack of masquerading on those node IPs. (Backport PR #25013, Upstream PR #24825, @christarazi)
Fix connectivity issue if nodes share the same name across the clustermesh and wireguard is enabled (Backport PR #25013, Upstream PR #24785, @giorio94)
Fix data race affecting the preferred mark in backends, e.g. backends selected by service with affinity set to local. In very rare cases a backend might be missing its preferred status and a non-local backend might be selected. (Backport PR #25346, Upstream PR #25087, @joamaki)
Fix incorrect network policy ebpf setup that may lead to incorrect packets denies when CEP is present in multiple CES (Backport PR #25184, Upstream PR #24838, @alan-kut)
Fix operator shutdown hanging when kvstore is enabled (Backport PR #25223, Upstream PR #24979, @giorio94)
Fix operator startup delay caused by leader election lease not being released correctly (Backport PR #25137, Upstream PR #24978, @giorio94)
Fix panic due to assignment to nil BGP service announcements map. (Backport PR #25013, Upstream PR #24985, @harsimran-pabla)
Fix permission issue when copying cni plugins onto host path (Backport PR #25346, Upstream PR #24891, @JohnJAS)
Fix security-group-tags not working in ENI (Backport PR #25013, Upstream PR #24951, @aanm)
Fix spurious errors containing "Failed to map node IP address to allocated ID". (Backport PR #25346, Upstream PR #25222, @bimmlerd)
Fix syncing of relevant node annotations into CiliumNode (Backport PR #25368, Upstream PR #25307, @meyskens)
Fix the bug when long-living connections using egress gateway may be reset. (Backport PR #25346, Upstream PR #24905, @gentoo-root)
ipcache don't short-circuit InjectLabels if source differs (Backport PR #25077, Upstream PR #24875, @squeed)
pkg/kvstore: Fix for deadlock in etcd status checker (Backport PR #25013, Upstream PR #24786, @hemanthmalla)
Track reply packets in long-living egress gateway connections and SNATed host-local connections. (Backport PR #25424, Upstream PR #25112, @gentoo-root)
When using KPR Nodeport with DSR, support backends in hostNetwork or with L7 policies. (Backport PR #24795, Upstream PR #22978, @julianwiedmann)

CI Changes:

Always use the 8.8.8.8 DNS resolver in kind (Backport PR #25409, Upstream PR #24713, @aspsk)
ci: remove STATUS commands from upstream tests' Jenkinsfile (Backport PR #25137, Upstream PR #25046, @nbusseneau)
Delete "Cilium monitor verbose mode" test (Backport PR #25346, Upstream PR #25212, @michi-covalent)
Enable testing of BPF programs requiring XDP_TX in CI (Backport PR #25409, Upstream PR #24250, @lmb)
inctimer: fix test flake where timer does not fire within time. (Backport PR #25346, Upstream PR #25219, @tommyp1ckles)
jenkinsfiles: Fix order of ginkgo tests (Backport PR #25137, Upstream PR #25002, @pchaigno)
mlh: update Jenkins jobs following removal of kernel 4.9 support (#24955, @nbusseneau)
test: Unquarantine host firewall + nodeport test (Backport PR #25184, Upstream PR #25025, @pchaigno)

Misc Changes:

bpf: dsr: don't track L2 addresses for DSR traffic (Backport PR #24795, Upstream PR #24524, @julianwiedmann)
bpf: dsr: restore CB_SRC_LABEL across DSR-INGRESS tail-call (Backport PR #24795, Upstream PR #24794, @julianwiedmann)
bpf: lb: introduce an optimized CT lookup (Backport PR #24795, Upstream PR #22936, @julianwiedmann)
bpf: minor CT cleanups (Backport PR #24795, Upstream PR #23718, @julianwiedmann)
bpf: nodeport: minor DSR improvements (Backport PR #24795, Upstream PR #23326, @julianwiedmann)
chore(deps): update docker.io/library/golang:1.19.8 docker digest to 9f2dd04 (v1.13) (#25421, @renovate[bot])
chore(deps): update hubble cli to v0.11.5 (v1.13) (patch) (#25125, @renovate[bot])
daemon: Mark CES feature as beta in agent flag (Backport PR #25013, Upstream PR #24850, @pchaigno)
docs: socketLB.hostNamespaceOnly also needed for gVisor (Backport PR #25346, Upstream PR #25322, @pchaigno)
docs: Add matrix version between envoy and cilium (Backport PR #25223, Upstream PR #25109, @sayboras)
docs: Add platform support to docs (Backport PR #25223, Upstream PR #25174, @joestringer)
docs: small fixes for k8s upgrade guide (Backport PR #25013, Upstream PR #24869, @tklauser)
Documentation: add migration document (Backport PR #25013, Upstream PR #23751, @squeed)
documentation: move policy warning to v1.13.2 section (#24997, @squeed)
envoy: Debug log remote IDs for Envoy policies (Backport PR #25013, Upstream PR #24939, @jrajahalme)
Fix missed clustermesh config change race condition with back-to-back changes (Backport PR #25013, Upstream PR #24993, @giorio94)
Fix possible panic in the ipcache when removing the prefix labels for an unknown resource ID (Backport PR #25346, Upstream PR #25230, @giorio94)
Fixed documentation regarding cilium versioning scheme and support (Backport PR #25223, Upstream PR #25171, @ayesha-kr)
gha: Add retry mechanism in http test (Backport PR #25346, Upstream PR #25244, @sayboras)
helm: add clustermesh nodeport config warning about known bug #24692 (Backport PR #25223, Upstream PR #25033, @giorio94)
hive: Don't log interrupt signal as error (Backport PR #25013, Upstream PR #23880, @joamaki)
ipsec: Install default-drop XFRM policy sooner (Backport PR #25346, Upstream PR #25257, @pchaigno)
Makefile: use a specific template for mktemp files (Backport PR #25223, Upstream PR #25192, @kaworu)
node/manager: Only remove old IPs if they weren't already added (Backport PR #25013, Upstream PR #25067, @christarazi)
pkg/service: Backends leak follow ups with revised fixes, debugging improvements and unit tests (Backport PR #25223, Upstream PR #24770, @aditighag)
Remote node identities are enabled by default in the Cilium agent. They have already been enabled by default in the Helm charts since Cilium version 1.7. (Backport PR #25013, Upstream PR #24874, @tklauser)
Update the documentation for required IAM policy rights needed for Cilium to work in EKS. (Backport PR #25137, Upstream PR #25078, @toredash)
Update threat model (Backport PR #25013, Upstream PR #24760, @ferozsalam)

Other Changes:

[v1.13] contrib/backporting: Fix main branch reference (#25091, @joestringer)
envoy: Upgrade to v1.23.9 (#25208, @sayboras)
install: Update image digests for v1.13.2 (#24952, @gentoo-root)
v1.13: docs: Document upgrade impact for IPsec (#24963, @pchaigno)
v1.13: docs: Fix typo in IPsec upgrade note (#24973, @pchaigno)

Docker Manifests

cilium

docker.io/cilium/cilium:v1.13.3@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314
quay.io/cilium/cilium:v1.13.3@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314
docker.io/cilium/cilium:stable@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314
quay.io/cilium/cilium:stable@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.13.3@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a
quay.io/cilium/clustermesh-apiserver:v1.13.3@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a
docker.io/cilium/clustermesh-apiserver:stable@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a
quay.io/cilium/clustermesh-apiserver:stable@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a

docker-plugin

docker.io/cilium/docker-plugin:v1.13.3@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860
quay.io/cilium/docker-plugin:v1.13.3@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860
docker.io/cilium/docker-plugin:stable@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860
quay.io/cilium/docker-plugin:stable@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860

hubble-relay

docker.io/cilium/hubble-relay:v1.13.3@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6
quay.io/cilium/hubble-relay:v1.13.3@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6
docker.io/cilium/hubble-relay:stable@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6
quay.io/cilium/hubble-relay:stable@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.13.3@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb
quay.io/cilium/operator-alibabacloud:v1.13.3@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb
docker.io/cilium/operator-alibabacloud:stable@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb
quay.io/cilium/operator-alibabacloud:stable@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb

operator-aws

docker.io/cilium/operator-aws:v1.13.3@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae
quay.io/cilium/operator-aws:v1.13.3@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae
docker.io/cilium/operator-aws:stable@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae
quay.io/cilium/operator-aws:stable@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae

operator-azure

docker.io/cilium/operator-azure:v1.13.3@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8
quay.io/cilium/operator-azure:v1.13.3@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8
docker.io/cilium/operator-azure:stable@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8
quay.io/cilium/operator-azure:stable@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8

operator-generic

docker.io/cilium/operator-generic:v1.13.3@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910
quay.io/cilium/operator-generic:v1.13.3@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910
docker.io/cilium/operator-generic:stable@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910
quay.io/cilium/operator-generic:stable@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910

operator

docker.io/cilium/operator:v1.13.3@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c
quay.io/cilium/operator:v1.13.3@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c
docker.io/cilium/operator:stable@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c
quay.io/cilium/operator:stable@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.13.2` -> `1.13.3` | --- ### Release Notes <details> <summary>cilium/cilium</summary> ### [`v1.13.3`](https://github.com/cilium/cilium/releases/tag/v1.13.3): 1.13.3 [Compare Source](https://github.com/cilium/cilium/compare/1.13.2...1.13.3) We are pleased to release Cilium v1.13.3. This release fixes bugs in ipsec and policy implementations and is recommended for all users. ## Summary of Changes **Major Changes:** - Assume Ingress identity for cluster internal traffic through Cilium Ingress for policy enforcement. (Backport PR [#25019](https://github.com/cilium/cilium/issues/25019), Upstream PR [#24826](https://github.com/cilium/cilium/issues/24826), [@jrajahalme](https://github.com/jrajahalme)) - policy: Promote Deny Policies from Beta to Stable ([#25427](https://github.com/cilium/cilium/issues/25427), [@nathanjsweet](https://github.com/nathanjsweet)) **Minor Changes:** - Drop traffic matching an egress gateway policy when no gateway are found (Backport PR [#24999](https://github.com/cilium/cilium/issues/24999), Upstream PR [#24835](https://github.com/cilium/cilium/issues/24835), [@MrFreezeex](https://github.com/MrFreezeex)) - ingress: Add ownerReferences for shared mode (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24942](https://github.com/cilium/cilium/issues/24942), [@sayboras](https://github.com/sayboras)) - sysdump: Added Kubernetes CNI logs to sysdump. (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#23937](https://github.com/cilium/cilium/issues/23937), [@marseel](https://github.com/marseel)) - Update CNI (loopback) to 1.3.0 (Backport PR [#25454](https://github.com/cilium/cilium/issues/25454), Upstream PR [#25400](https://github.com/cilium/cilium/issues/25400), [@anfernee](https://github.com/anfernee)) - Use BGP Control Plane annotations from Node Resource for creation of CiliumNode Resource (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#24914](https://github.com/cilium/cilium/issues/24914), [@margau](https://github.com/margau)) **Bugfixes:** - Add support for builtin kernel modules (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#23953](https://github.com/cilium/cilium/issues/23953), [@TheAifam5](https://github.com/TheAifam5)) - Address cilium-agent startup performance regression. (Backport PR [#25185](https://github.com/cilium/cilium/issues/25185), Upstream PR [#25007](https://github.com/cilium/cilium/issues/25007), [@bimmlerd](https://github.com/bimmlerd)) - cmd/cleanup: Fix cleanup of generic XDP programs (Backport PR [#25184](https://github.com/cilium/cilium/issues/25184), Upstream PR [#25117](https://github.com/cilium/cilium/issues/25117), [@pchaigno](https://github.com/pchaigno)) - datapath: Fix double SNAT (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#25189](https://github.com/cilium/cilium/issues/25189), [@brb](https://github.com/brb)) - DNS proxy now always updates the proxy policy to avoid intermittent policy drops. (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25147](https://github.com/cilium/cilium/issues/25147), [@jrajahalme](https://github.com/jrajahalme)) - Filter ipv6 advertisements when using metallb as BGP speaker. (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#25043](https://github.com/cilium/cilium/issues/25043), [@harsimran-pabla](https://github.com/harsimran-pabla)) - Fix a regression in which link-local addresses were not treated with the "host" identity in some circumstances. (Backport PR [#25368](https://github.com/cilium/cilium/issues/25368), Upstream PR [#25298](https://github.com/cilium/cilium/issues/25298), [@asauber](https://github.com/asauber)) - Fix broken IPv4 connectivity from outside to NodePort service when using L7 ingress policy, by removing PROXY_RT route table. (Backport PR [#25086](https://github.com/cilium/cilium/issues/25086), Upstream PR [#24807](https://github.com/cilium/cilium/issues/24807), [@jschwinger233](https://github.com/jschwinger233)) - Fix bug that caused ToCIDR netpols matching kube-apiserver IPs (when external to the cluster) to not reliably allow connectivity. ([#25241](https://github.com/cilium/cilium/issues/25241), [@giorio94](https://github.com/giorio94)) - Fix bug that causes enforcement of host policies on reply IPv6 pod traffic. (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#25024](https://github.com/cilium/cilium/issues/25024), [@pchaigno](https://github.com/pchaigno)) - Fix bug where Cilium configurations running with tunneling disabled, BPF-masq disabled, but with masquerading enabled, do not clean up ipset configuration when a node IP changes. This can lead to a lack of masquerading on those node IPs. (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24825](https://github.com/cilium/cilium/issues/24825), [@christarazi](https://github.com/christarazi)) - Fix connectivity issue if nodes share the same name across the clustermesh and wireguard is enabled (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24785](https://github.com/cilium/cilium/issues/24785), [@giorio94](https://github.com/giorio94)) - Fix data race affecting the preferred mark in backends, e.g. backends selected by service with affinity set to local. In very rare cases a backend might be missing its preferred status and a non-local backend might be selected. (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25087](https://github.com/cilium/cilium/issues/25087), [@joamaki](https://github.com/joamaki)) - Fix incorrect network policy ebpf setup that may lead to incorrect packets denies when CEP is present in multiple CES (Backport PR [#25184](https://github.com/cilium/cilium/issues/25184), Upstream PR [#24838](https://github.com/cilium/cilium/issues/24838), [@alan-kut](https://github.com/alan-kut)) - Fix operator shutdown hanging when kvstore is enabled (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#24979](https://github.com/cilium/cilium/issues/24979), [@giorio94](https://github.com/giorio94)) - Fix operator startup delay caused by leader election lease not being released correctly (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#24978](https://github.com/cilium/cilium/issues/24978), [@giorio94](https://github.com/giorio94)) - Fix panic due to assignment to nil BGP service announcements map. (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24985](https://github.com/cilium/cilium/issues/24985), [@harsimran-pabla](https://github.com/harsimran-pabla)) - Fix permission issue when copying cni plugins onto host path (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#24891](https://github.com/cilium/cilium/issues/24891), [@JohnJAS](https://github.com/JohnJAS)) - Fix security-group-tags not working in ENI (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24951](https://github.com/cilium/cilium/issues/24951), [@aanm](https://github.com/aanm)) - Fix spurious errors containing "Failed to map node IP address to allocated ID". (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25222](https://github.com/cilium/cilium/issues/25222), [@bimmlerd](https://github.com/bimmlerd)) - Fix syncing of relevant node annotations into CiliumNode (Backport PR [#25368](https://github.com/cilium/cilium/issues/25368), Upstream PR [#25307](https://github.com/cilium/cilium/issues/25307), [@meyskens](https://github.com/meyskens)) - Fix the bug when long-living connections using egress gateway may be reset. (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#24905](https://github.com/cilium/cilium/issues/24905), [@gentoo-root](https://github.com/gentoo-root)) - ipcache don't short-circuit InjectLabels if source differs (Backport PR [#25077](https://github.com/cilium/cilium/issues/25077), Upstream PR [#24875](https://github.com/cilium/cilium/issues/24875), [@squeed](https://github.com/squeed)) - pkg/kvstore: Fix for deadlock in etcd status checker (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24786](https://github.com/cilium/cilium/issues/24786), [@hemanthmalla](https://github.com/hemanthmalla)) - Track reply packets in long-living egress gateway connections and SNATed host-local connections. (Backport PR [#25424](https://github.com/cilium/cilium/issues/25424), Upstream PR [#25112](https://github.com/cilium/cilium/issues/25112), [@gentoo-root](https://github.com/gentoo-root)) - When using KPR Nodeport with DSR, support backends in hostNetwork or with L7 policies. (Backport PR [#24795](https://github.com/cilium/cilium/issues/24795), Upstream PR [#22978](https://github.com/cilium/cilium/issues/22978), [@julianwiedmann](https://github.com/julianwiedmann)) **CI Changes:** - Always use the 8.8.8.8 DNS resolver in kind (Backport PR [#25409](https://github.com/cilium/cilium/issues/25409), Upstream PR [#24713](https://github.com/cilium/cilium/issues/24713), [@aspsk](https://github.com/aspsk)) - ci: remove `STATUS` commands from upstream tests' Jenkinsfile (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#25046](https://github.com/cilium/cilium/issues/25046), [@nbusseneau](https://github.com/nbusseneau)) - Delete "Cilium monitor verbose mode" test (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25212](https://github.com/cilium/cilium/issues/25212), [@michi-covalent](https://github.com/michi-covalent)) - Enable testing of BPF programs requiring XDP_TX in CI (Backport PR [#25409](https://github.com/cilium/cilium/issues/25409), Upstream PR [#24250](https://github.com/cilium/cilium/issues/24250), [@lmb](https://github.com/lmb)) - inctimer: fix test flake where timer does not fire within time. (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25219](https://github.com/cilium/cilium/issues/25219), [@tommyp1ckles](https://github.com/tommyp1ckles)) - jenkinsfiles: Fix order of ginkgo tests (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#25002](https://github.com/cilium/cilium/issues/25002), [@pchaigno](https://github.com/pchaigno)) - mlh: update Jenkins jobs following removal of kernel 4.9 support ([#24955](https://github.com/cilium/cilium/issues/24955), [@nbusseneau](https://github.com/nbusseneau)) - test: Unquarantine host firewall + nodeport test (Backport PR [#25184](https://github.com/cilium/cilium/issues/25184), Upstream PR [#25025](https://github.com/cilium/cilium/issues/25025), [@pchaigno](https://github.com/pchaigno)) **Misc Changes:** - bpf: dsr: don't track L2 addresses for DSR traffic (Backport PR [#24795](https://github.com/cilium/cilium/issues/24795), Upstream PR [#24524](https://github.com/cilium/cilium/issues/24524), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: restore CB_SRC_LABEL across DSR-INGRESS tail-call (Backport PR [#24795](https://github.com/cilium/cilium/issues/24795), Upstream PR [#24794](https://github.com/cilium/cilium/issues/24794), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: introduce an optimized CT lookup (Backport PR [#24795](https://github.com/cilium/cilium/issues/24795), Upstream PR [#22936](https://github.com/cilium/cilium/issues/22936), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: minor CT cleanups (Backport PR [#24795](https://github.com/cilium/cilium/issues/24795), Upstream PR [#23718](https://github.com/cilium/cilium/issues/23718), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: nodeport: minor DSR improvements (Backport PR [#24795](https://github.com/cilium/cilium/issues/24795), Upstream PR [#23326](https://github.com/cilium/cilium/issues/23326), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update docker.io/library/golang:1.19.8 docker digest to [`9f2dd04`](https://github.com/cilium/cilium/commit/9f2dd04) (v1.13) ([#25421](https://github.com/cilium/cilium/issues/25421), [@renovate](https://github.com/renovate)\[bot]) - chore(deps): update hubble cli to v0.11.5 (v1.13) (patch) ([#25125](https://github.com/cilium/cilium/issues/25125), [@renovate](https://github.com/renovate)\[bot]) - daemon: Mark CES feature as beta in agent flag (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24850](https://github.com/cilium/cilium/issues/24850), [@pchaigno](https://github.com/pchaigno)) - docs: `socketLB.hostNamespaceOnly` also needed for gVisor (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25322](https://github.com/cilium/cilium/issues/25322), [@pchaigno](https://github.com/pchaigno)) - docs: Add matrix version between envoy and cilium (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#25109](https://github.com/cilium/cilium/issues/25109), [@sayboras](https://github.com/sayboras)) - docs: Add platform support to docs (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#25174](https://github.com/cilium/cilium/issues/25174), [@joestringer](https://github.com/joestringer)) - docs: small fixes for k8s upgrade guide (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24869](https://github.com/cilium/cilium/issues/24869), [@tklauser](https://github.com/tklauser)) - Documentation: add migration document (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#23751](https://github.com/cilium/cilium/issues/23751), [@squeed](https://github.com/squeed)) - documentation: move policy warning to v1.13.2 section ([#24997](https://github.com/cilium/cilium/issues/24997), [@squeed](https://github.com/squeed)) - envoy: Debug log remote IDs for Envoy policies (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24939](https://github.com/cilium/cilium/issues/24939), [@jrajahalme](https://github.com/jrajahalme)) - Fix missed clustermesh config change race condition with back-to-back changes (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24993](https://github.com/cilium/cilium/issues/24993), [@giorio94](https://github.com/giorio94)) - Fix possible panic in the ipcache when removing the prefix labels for an unknown resource ID (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25230](https://github.com/cilium/cilium/issues/25230), [@giorio94](https://github.com/giorio94)) - Fixed documentation regarding cilium versioning scheme and support (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#25171](https://github.com/cilium/cilium/issues/25171), [@ayesha-kr](https://github.com/ayesha-kr)) - gha: Add retry mechanism in http test (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25244](https://github.com/cilium/cilium/issues/25244), [@sayboras](https://github.com/sayboras)) - helm: add clustermesh nodeport config warning about known bug [#24692](https://github.com/cilium/cilium/issues/24692) (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#25033](https://github.com/cilium/cilium/issues/25033), [@giorio94](https://github.com/giorio94)) - hive: Don't log interrupt signal as error (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#23880](https://github.com/cilium/cilium/issues/23880), [@joamaki](https://github.com/joamaki)) - ipsec: Install default-drop XFRM policy sooner (Backport PR [#25346](https://github.com/cilium/cilium/issues/25346), Upstream PR [#25257](https://github.com/cilium/cilium/issues/25257), [@pchaigno](https://github.com/pchaigno)) - Makefile: use a specific template for mktemp files (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#25192](https://github.com/cilium/cilium/issues/25192), [@kaworu](https://github.com/kaworu)) - node/manager: Only remove old IPs if they weren't already added (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#25067](https://github.com/cilium/cilium/issues/25067), [@christarazi](https://github.com/christarazi)) - pkg/service: Backends leak follow ups with revised fixes, debugging improvements and unit tests (Backport PR [#25223](https://github.com/cilium/cilium/issues/25223), Upstream PR [#24770](https://github.com/cilium/cilium/issues/24770), [@aditighag](https://github.com/aditighag)) - Remote node identities are enabled by default in the Cilium agent. They have already been enabled by default in the Helm charts since Cilium version 1.7. (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24874](https://github.com/cilium/cilium/issues/24874), [@tklauser](https://github.com/tklauser)) - Update the documentation for required IAM policy rights needed for Cilium to work in EKS. (Backport PR [#25137](https://github.com/cilium/cilium/issues/25137), Upstream PR [#25078](https://github.com/cilium/cilium/issues/25078), [@toredash](https://github.com/toredash)) - Update threat model (Backport PR [#25013](https://github.com/cilium/cilium/issues/25013), Upstream PR [#24760](https://github.com/cilium/cilium/issues/24760), [@ferozsalam](https://github.com/ferozsalam)) **Other Changes:** - \[v1.13] contrib/backporting: Fix main branch reference ([#25091](https://github.com/cilium/cilium/issues/25091), [@joestringer](https://github.com/joestringer)) - envoy: Upgrade to v1.23.9 ([#25208](https://github.com/cilium/cilium/issues/25208), [@sayboras](https://github.com/sayboras)) - install: Update image digests for v1.13.2 ([#24952](https://github.com/cilium/cilium/issues/24952), [@gentoo-root](https://github.com/gentoo-root)) - v1.13: docs: Document upgrade impact for IPsec ([#24963](https://github.com/cilium/cilium/issues/24963), [@pchaigno](https://github.com/pchaigno)) - v1.13: docs: Fix typo in IPsec upgrade note ([#24973](https://github.com/cilium/cilium/issues/24973), [@pchaigno](https://github.com/pchaigno)) #### Docker Manifests ##### cilium `docker.io/cilium/cilium:v1.13.3@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314` `quay.io/cilium/cilium:v1.13.3@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314` `docker.io/cilium/cilium:stable@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314` `quay.io/cilium/cilium:stable@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314` ##### clustermesh-apiserver `docker.io/cilium/clustermesh-apiserver:v1.13.3@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a` `quay.io/cilium/clustermesh-apiserver:v1.13.3@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a` `docker.io/cilium/clustermesh-apiserver:stable@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a` `quay.io/cilium/clustermesh-apiserver:stable@sha256:5ad8e9dc17f5677d1d75b53a4e80ec2e5c4fcf4973ced8b30f8ad53933c6969a` ##### docker-plugin `docker.io/cilium/docker-plugin:v1.13.3@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860` `quay.io/cilium/docker-plugin:v1.13.3@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860` `docker.io/cilium/docker-plugin:stable@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860` `quay.io/cilium/docker-plugin:stable@sha256:e94d344c8e059ce87453dff579086bd0bed9d65e69434ad60eef783380c4e860` ##### hubble-relay `docker.io/cilium/hubble-relay:v1.13.3@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6` `quay.io/cilium/hubble-relay:v1.13.3@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6` `docker.io/cilium/hubble-relay:stable@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6` `quay.io/cilium/hubble-relay:stable@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6` ##### operator-alibabacloud `docker.io/cilium/operator-alibabacloud:v1.13.3@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb` `quay.io/cilium/operator-alibabacloud:v1.13.3@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb` `docker.io/cilium/operator-alibabacloud:stable@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb` `quay.io/cilium/operator-alibabacloud:stable@sha256:8dba4795cb38200746a2236623f5b84742ee2c56a8afda724c85f5027ea854eb` ##### operator-aws `docker.io/cilium/operator-aws:v1.13.3@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae` `quay.io/cilium/operator-aws:v1.13.3@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae` `docker.io/cilium/operator-aws:stable@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae` `quay.io/cilium/operator-aws:stable@sha256:394c40d156235d3c2004f77bb73402457092351cc6debdbc5727ba36fbd863ae` ##### operator-azure `docker.io/cilium/operator-azure:v1.13.3@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8` `quay.io/cilium/operator-azure:v1.13.3@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8` `docker.io/cilium/operator-azure:stable@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8` `quay.io/cilium/operator-azure:stable@sha256:7749b732d510954d9fb74f7e675b31b49100fd773e588c6fbbf42529acfb1be8` ##### operator-generic `docker.io/cilium/operator-generic:v1.13.3@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910` `quay.io/cilium/operator-generic:v1.13.3@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910` `docker.io/cilium/operator-generic:stable@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910` `quay.io/cilium/operator-generic:stable@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910` ##### operator `docker.io/cilium/operator:v1.13.3@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c` `quay.io/cilium/operator:v1.13.3@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c` `docker.io/cilium/operator:stable@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c` `quay.io/cilium/operator:stable@sha256:70245141d9c38df09c4c3884f61af81036672059b1ae45e8b1e2175b6cc0998c` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit 2023-05-30 12:08:42 +00:00

ci/woodpecker/push/woodpecker Pipeline is pending

Details

ci/woodpecker/pr/woodpecker Pipeline is pending

Details

fb508b222c Update Helm release cilium to v1.13.3

tobru merged commit 58f83fc3fc into main

2023-05-30 12:09:55 +00:00

tobru deleted branch renovate/cilium-1.x

2023-05-30 12:09:55 +00:00

tobru referenced this pull request from a commit

2023-05-30 12:09:55 +00:00

Merge pull request 'Update Helm release cilium to v1.13.3' (#171) from renovate/cilium-1.x into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: tobru/gitops-zurrli#171

No description provided.

Update Helm release cilium to v1.13.3 #171

Release Notes

v1.13.3: 1.13.3

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

Configuration

`v1.13.3`: 1.13.3