chore(deps): update kubezero-network-dependencies #32

renovate · 2024-11-21T03:03:07Z

renovate commented

2024-11-21 03:03:07 +00:00

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.16.3` -> `1.16.5`
metallb (source)	patch	`0.14.8` -> `0.14.9`

Release Notes

cilium/cilium (cilium)

`v1.16.5`: 1.16.5

Compare Source

Summary of Changes

Minor Changes:

hubble: Stop building 32-bit binaries (Backport PR #36066, Upstream PR #35974, @michi-covalent)

Bugfixes:

Address potential connectivity disruption when using either L7 / DNS Network policies in combination with per-endpoint routes and hostLegacyRouting, or L7 / DNS network policies in combination with IPsec network encryption. (Backport PR #36540, Upstream PR #36484, @julianwiedmann)
bgp: fix race in bgp stores (Backport PR #36066, Upstream PR #35971, @harsimran-pabla)
BGPv1: Fix race by reconciliation of services with externalTrafficPolicy=Local by populating locally available services after performing service diff (Backport PR #36286, Upstream PR #36230, @rastislavs)
BGPv2: Fix race by reconciliation of services with externalTrafficPolicy=Local by populating locally available services after performing service diff (Backport PR #36286, Upstream PR #36165, @rastislavs)
Cilium agent now waits until endpoints have restored before starting accepting new xDS streams. (Backport PR #36049, Upstream PR #35984, @jrajahalme)
Cilium no longer keeps old DNS-IP mappings alive while reaping newer ones, leading to spurious drops in connections to domains with many IPs associated. (Backport PR #36462, Upstream PR #36252, @bimmlerd)
cilium-health-ep controller is made to be more robust against successive failures. (Backport PR #36066, Upstream PR #35936, @jrajahalme)
DNS proxy port is no longer released when endpoint with a DNS policy fails to regenerate successfully. A potential deadlock between CEC/CCEC parser and endpoint policy update is removed. (Backport PR #36468, Upstream PR #36142, @jrajahalme)
Envoy "initial fetch timeout" warnings are now demoted to info level, as they are expected to happen during Cilium Agent restart. (Backport PR #36049, Upstream PR #36060, @jrajahalme)
Fix an issue where pod-to-world traffic goes up stack when BPF host routing is enabled with tunnel. (Backport PR #35861, Upstream PR #35098, @jschwinger233)
Fix identity leak for kvstore identity mode (Backport PR #36066, Upstream PR #34893, @odinuge)
Fix potential Cilium agent panic during endpoint restoration, occurring if the corresponding pod gets deleted while the agent is restarting. This regression only affects Cilium v1.16.4. (Backport PR #36302, Upstream PR #36292, @giorio94)
gateway-api: Fix gateway checks for namespace (Backport PR #36462, Upstream PR #35452, @sayboras)
gha: Remove hostLegacyRouting in clustermesh (Backport PR #36357, Upstream PR #35418, @sayboras)
helm: Use an absolute FQDN for the Hubble peer-service endpoint to avoid incorrect DNS resolution outside the cluster (Backport PR #36066, Upstream PR #36005, @devodev)
hubble: consistently use v as prefix for the Hubble version (Backport PR #36286, Upstream PR #35891, @rolinh)
iptables: Fix data race in iptables manager (Backport PR #36066, Upstream PR #35902, @pippolo84)
lrp: update LRP services with stale backends on agent restart (Backport PR #36106, Upstream PR #36036, @ysksuzuki)
policy: Fix bug that allowed port ranges to be attached to L7 policies, which is not permitted. (#36050, @nathanjsweet)
Unbreak the cilium-dbg preflight migrate-identity command (Backport PR #36286, Upstream PR #36089, @giorio94)
Use strconv.Itoa instead of string() for the correct behavior when converting kafka.ErrorCode from int32 to string. Add relevant unit tests for Kafka plugin and handler. (Backport PR #36066, Upstream PR #35856, @nddq)

CI Changes:

v1.16] ci: modularize chart CI push workflow ([#&#8203;35958](https://github.com/cilium/cilium/issues/35958), [@&#8203;ferozsalam](https://github.com/ferozsalam))

gh: conformance-clustermesh: test with IPsec + BPF NodePort (Backport PR #36462, Upstream PR #36384, @julianwiedmann)
gha: configure environment in build-images-base/image-digests job (Backport PR #36462, Upstream PR #36318, @giorio94)
node_local_store: prevent racey tests while using mock node store. (Backport PR #36066, Upstream PR #35945, @tommyp1ckles)
Remove unnecessary hubble port-forward commands (Backport PR #36066, Upstream PR #33523, @michi-covalent)

Misc Changes:

v1.16] docs: egress masquerade selector ([#&#8203;36333](https://github.com/cilium/cilium/issues/36333), [@&#8203;viktor-kurchenko](https://github.com/viktor-kurchenko))

v1.16] images: bump cni plugins to v1.6.0 ([#&#8203;36092](https://github.com/cilium/cilium/issues/36092), [@&#8203;ferozsalam](https://github.com/ferozsalam))

bugtool: dump tail-call map for bpf_wireguard (Backport PR #36286, Upstream PR #36183, @julianwiedmann)
chore(deps): update all github action dependencies (v1.16) (#36155, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (#36275, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (#36443, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (patch) (#36277, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (#35546, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (#36152, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (#36279, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (#36444, @cilium-renovate[bot])
chore(deps): update cilium/little-vm-helper action to v0.0.19 (v1.16) (#36153, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.22.9 docker digest to 147f428 (v1.16) (#36222, @cilium-renovate[bot])
chore(deps): update go to v1.22.10 (v1.16) (#36441, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.7-1732605705-2aa20ee3acb68cd38d57669af19508bea8f0ba62 (v1.16) (#36180, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8 (v1.16) (#36495, @cilium-renovate[bot])
chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20241129.013349 (v1.16) (#36278, @cilium-renovate[bot])
chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20241206.013345 (v1.16) (#36442, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.16) (patch) (#36154, @cilium-renovate[bot])
docs: Add the tls:// prefix before the IP address (Backport PR #36286, Upstream PR #36118, @liyihuang)
docs: Fix typo in multi-pool section title (Backport PR #36312, Upstream PR #36305, @joestringer)
docs: In k0s guide, remove dashes to fix invalid Bash variable names. (Backport PR #36066, Upstream PR #35923, @yilas)
docs: lrp: fix kernel version requirement for skipRedirectFromBackend (Backport PR #36066, Upstream PR #35921, @ysksuzuki)
docs: system-requirements: require 5.4 kernel (Backport PR #36462, Upstream PR #36386, @julianwiedmann)
docs: WireGuard doesn't require overlay port in Network Firewalls (Backport PR #36286, Upstream PR #36208, @julianwiedmann)
Endpoint populate new policymap early if empty (Backport PR #36479, Upstream PR #36361, @jrajahalme)
envoy: Configure internal_address_config to avoid warning log (Backport PR #36015, Upstream PR #35943, @sayboras)
envoy: Pass tofqdns-proxy-response-max-delay to Envoy (Backport PR #36468, Upstream PR #36330, @jrajahalme)
fix(deps): update module golang.org/x/crypto to v0.31.0 [security] (v1.16) (#36530, @cilium-renovate[bot])
Fixed BGP documentation (Backport PR #36066, Upstream PR #35953, @seadog007)
images: Use cilium-builder image instead of golang to build hubble (Backport PR #36312, Upstream PR #35697, @learnitall)
lrp: fix kernel version requirement in warning log (Backport PR #36286, Upstream PR #36141, @ysksuzuki)
Makefile: fix swagger definition for automatic renovate updates (Backport PR #36066, Upstream PR #35979, @aanm)
proxy: Take proxy port reference for new redirects immediately (Backport PR #36468, Upstream PR #36435, @jrajahalme)
proxyports: Resolve data races in test (Backport PR #36468, Upstream PR #36399, @jrajahalme)
proxyports: Sleep a bit longer in tests (Backport PR #36468, Upstream PR #36389, @jrajahalme)
Remove duplicated watch on services and endpoint in the cilium-agent (Backport PR #36066, Upstream PR #35838, @MrFreezeex)
Rework error handling logic in neighbor discovery (Backport PR #36093, Upstream PR #35144, @pippolo84)
Silence spurious clustermesh-related warnings (Backport PR #36225, Upstream PR #35867, @giorio94)
Update documentation for egress masquerading behavior (Backport PR #36462, Upstream PR #36267, @liyihuang)

Other Changes:

1.16] ci/ipsec-upgrade: increase cilium status wait duration ([#&#8203;36082](https://github.com/cilium/cilium/issues/36082), [@&#8203;harsimran-pabla](https://github.com/harsimran-pabla))

v1.16] cilium, service: Fix checkLBSrcRange propagation to LB map ([#&#8203;36511](https://github.com/cilium/cilium/issues/36511), [@&#8203;borkmann](https://github.com/borkmann))

install: Update image digests for v1.16.4 (#36047, @cilium-release-bot[bot])
jrajahalme/v1.16 cilium cli (#36541, @jrajahalme)
Revert "workflows/ipsec: Cover Ingress" (#36116, @harsimran-pabla)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.5@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d
quay.io/cilium/cilium:stable@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.5@sha256:37a7fdbef806b78ef63df9f1a9828fdddbf548d1f0e43b8eb10a6bdc8fa03958
quay.io/cilium/clustermesh-apiserver:stable@sha256:37a7fdbef806b78ef63df9f1a9828fdddbf548d1f0e43b8eb10a6bdc8fa03958

docker-plugin

quay.io/cilium/docker-plugin:v1.16.5@sha256:d6b4ed076ae921535c2a543d4b5b63af474288ee4501653a1f442c935beb5768
quay.io/cilium/docker-plugin:stable@sha256:d6b4ed076ae921535c2a543d4b5b63af474288ee4501653a1f442c935beb5768

hubble-relay

quay.io/cilium/hubble-relay:v1.16.5@sha256:6cfae1d1afa566ba941f03d4d7e141feddd05260e5cd0a1509aba1890a45ef00
quay.io/cilium/hubble-relay:stable@sha256:6cfae1d1afa566ba941f03d4d7e141feddd05260e5cd0a1509aba1890a45ef00

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.5@sha256:c0edf4c8d089e76d6565d3c57128b98bc6c73d14bb4590126ee746aeaedba5e0
quay.io/cilium/operator-alibabacloud:stable@sha256:c0edf4c8d089e76d6565d3c57128b98bc6c73d14bb4590126ee746aeaedba5e0

operator-aws

quay.io/cilium/operator-aws:v1.16.5@sha256:97e1fe0c2b522583033138eb10c170919d8de49d2788ceefdcff229a92210476
quay.io/cilium/operator-aws:stable@sha256:97e1fe0c2b522583033138eb10c170919d8de49d2788ceefdcff229a92210476

operator-azure

quay.io/cilium/operator-azure:v1.16.5@sha256:265e2b78f572c76b523f91757083ea5f0b9b73b82f2d9714e5a8fb848e4048f9
quay.io/cilium/operator-azure:stable@sha256:265e2b78f572c76b523f91757083ea5f0b9b73b82f2d9714e5a8fb848e4048f9

operator-generic

quay.io/cilium/operator-generic:v1.16.5@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039
quay.io/cilium/operator-generic:stable@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039

operator

quay.io/cilium/operator:v1.16.5@sha256:617896e1b23a2c4504ab2c84f17964e24dade3b5845f733b11847202230ca940
quay.io/cilium/operator:stable@sha256:617896e1b23a2c4504ab2c84f17964e24dade3b5845f733b11847202230ca940

`v1.16.4`: 1.16.4

Compare Source

Security Advisories

This release addresses https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67.

Summary of Changes

Minor Changes:

Added Helm option 'envoy.initialFetchTimeoutSeconds' (default 30 seconds) to override the Envoy default (15 seconds). (Backport PR #35908, Upstream PR #35809, @jrajahalme)
clustermesh: add guardrails for known broken ENI/aws-chaining + cluster ID combination (Backport PR #35543, Upstream PR #35349, @giorio94)
helm: Lower default hubble.tls.auto.certValidityDuration to 365 days (Backport PR #35781, Upstream PR #35630, @chancez)
helm: New socketLB.tracing flag (Backport PR #35781, Upstream PR #35747, @pchaigno)
hubble-relay: Return underlying connection errors when connecting to peer manager (Backport PR #35781, Upstream PR #35632, @chancez)
netkit: Fix issue where traffic originating from the host namespace fails to reach the pod when using endpoint routes and network policies. (Backport PR #35543, Upstream PR #35306, @jrife)

Bugfixes:

Avoid duplicate errors in health status for node-neighbor-link-updater (Backport PR #35468, Upstream PR #35179, @wedaly)
bgpv1: fix reconciliation of services with shared VIPs (Backport PR #35468, Upstream PR #35333, @rastislavs)
bgpv2,operator: Fix the race condition in the nodeSelector conflict detection logic (Backport PR #35863, Upstream PR #35690, @YutaroHayakawa)
bgpv2: set local peering address when specified (Backport PR #35781, Upstream PR #35552, @harsimran-pabla)
Cilium datapath now gives precedence for the more specific allow rule with L7 rules when rules with port ranges are present. (Backport PR #35603, Upstream PR #35150, @jrajahalme)
Cilium's DNS proxy no longer gets stuck for a specific five-tuple if an timeout waiting for response error is encountered. (Backport PR #35781, Upstream PR #35589, @bimmlerd)
config: Remove superfluous warning on native routing CIDR (Backport PR #35781, Upstream PR #35738, @gandro)
Fix missing flowlabel hash on SRv6 traffic. (Backport PR #35781, Upstream PR #35498, @akaliwod)
Fix packet drops for pod-to-pod connections that pass through ingress & egress proxy when using IPsec, caused by MTU misconfiguration. (Backport PR #35543, Upstream PR #35173, @smagnani96)
Fix possible disruption of long running pod to node traffic on agent restart in kvstore mode (Backport PR #35781, Upstream PR #35673, @giorio94)
Fix redirect from L3 device to remote endpoint via overlay network. (Backport PR #35468, Upstream PR #35165, @julianwiedmann)
Fixed a bug where replies for pod-originating connections came into scope of HostFW Ingress Network policy. Applicable to configurations that use iptables for Masquerading. (Backport PR #35908, Upstream PR #35694, @julianwiedmann)
Fixes a bug where the operator incorrectly flagged CiliumNetworkPolicies containing ICMP rules as invalid. (Backport PR #35781, Upstream PR #35599, @squeed)
Fixes a performance regression when ingesting network policies in clusters with large numbers of Services. (Backport PR #35543, Upstream PR #35293, @squeed)
Fixes a potential deadlock when restarting cilium agent with pods with DNS interception configured (Backport PR #35906, Upstream PR #35890, @squeed)
Fixes BPF Masquerading exclusion CIDR for IPAM modes "eni", "azure" and "alibabacloud". (#35611, @pippolo84)
helm: Fix configmap unmarshal error on egressGateway.maxPolicyEntries (Backport PR #35319, Upstream PR #35301, @hox)
helm: fix duplicate configmap key for bpf-lb-sock-terminate-pod-connections (Backport PR #35781, Upstream PR #35703, @solidDoWant)
helm: set automountServiceAccountToken to false for hubble-relay sa (Backport PR #35781, Upstream PR #35674, @ayuspin)
hubble: fix endpoint cluster name (Backport PR #35781, Upstream PR #35415, @kaworu)
hubble: Lock exporters while gathering metrics (Backport PR #35908, Upstream PR #35860, @joestringer)
Ingress endpoint is now included in the lxcmap so that ARP and ND6 work for them. (Backport PR #35781, Upstream PR #35143, @jrajahalme)
ipam: Validate CiliumNode resource in ENI mode (Backport PR #35792, Upstream PR #35784, @sayboras)
l7lb: fix registration of flag loadbalancer-l7 (Backport PR #35781, Upstream PR #35623, @mhofstetter)
Log errors when reloading hubble exporter configuration dynamically and do not attempt to close os.Stdout (Backport PR #35319, Upstream PR #35069, @chancez)
option: Reduce log level for WG strict mode + IPv6 (Backport PR #35908, Upstream PR #35763, @pchaigno)
Policy properly propagates proxy listener name and priority from a L3 wildcard rule with policies requiring authentication. (Backport PR #35468, Upstream PR #35381, @jrajahalme)
treewide: Add wrapper for netlink functions that may fail with ErrDumpInterrupted (Backport PR #35654, Upstream PR #35614, @gandro)
wireguard: Fix connectivity issues following node reboots. (Backport PR #35908, Upstream PR #35750, @jrife)

CI Changes:

.github/conformance-ginkgo: replace deprecated jq flag (Backport PR #35468, Upstream PR #35399, @aanm)
.github: extend timeout for tests-ipsec-upgrade workflow (Backport PR #35781, Upstream PR #35657, @rastislavs)
.github: remove libncurses5 from integration tests (Backport PR #35468, Upstream PR #35408, @aanm)

v1.16] gh: e2e-upgrade: restart LRP backend pod after upgrade ([#&#8203;35329](https://github.com/cilium/cilium/issues/35329), [@&#8203;ysksuzuki](https://github.com/ysksuzuki))

v1.16] github: update rhel8 LVH image to rhel8.6 ([#&#8203;35733](https://github.com/cilium/cilium/issues/35733), [@&#8203;julianwiedmann](https://github.com/julianwiedmann))

Additionally test KVStore mode in E2E/IPSec workflows (Backport PR #35905, Upstream PR #35679, @giorio94)
ci: conformance-kind: re-enable flaky Aggregator test (Backport PR #35582, Upstream PR #35286, @julianwiedmann)
ci: datapath-verifier: bump lvh images (Backport PR #35648, Upstream PR #35456, @julianwiedmann)
gha: Update chmod command (Backport PR #35468, Upstream PR #35400, @sayboras)
github: Pass the workflow step timeout to go test (Backport PR #35908, Upstream PR #35814, @jrajahalme)
Refactor and set a default for GH_RUNNER_EXTRA_POWER (Backport PR #35319, Upstream PR #35267, @aanm)
workflows/gateway-api: Cover IPsec with GatewayAPI (Backport PR #35908, Upstream PR #35584, @pchaigno)
workflows/ingress: Run basic checks (Backport PR #35908, Upstream PR #35683, @pchaigno)
workflows/ipsec: Cover Ingress (Backport PR #35908, Upstream PR #35476, @pchaigno)
workflows: Extend IPsec tests to cover egress gateway (Backport PR #35540, Upstream PR #35323, @pchaigno)

Misc Changes:

.github/build-images-base: checkout base branch to get scripts (Backport PR #35319, Upstream PR #35236, @aanm)
.github: remove retention days for image digests (Backport PR #35468, Upstream PR #35457, @aanm)
bpf: vxlan helper improvements (Backport PR #35543, Upstream PR #34755, @julianwiedmann)
chore(deps): update all github action dependencies (v1.16) (#35382, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (#35439, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (#35573, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.16) (#35710, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.16) (#35438, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.22.8 docker digest to 0ca97f4 (v1.16) (#35730, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.22.8 docker digest to b274ff1 (v1.16) (#35379, @cilium-renovate[bot])
chore(deps): update go to v1.22.9 (v1.16) (#35854, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1729635771-fa4efeff33a344a45e14a4068c61dc438b3d2270 (v1.16) (#35491, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.16) (patch) (#35731, @cilium-renovate[bot])
cilium, docs: Extend requirements for L7 proxy (Backport PR #35781, Upstream PR #35669, @borkmann)
cilium: add probe for netkit for more user friendly error when not supported (Backport PR #35781, Upstream PR #35551, @borkmann)
ctrl-runtime: lower severity of retryable reconcile errors (Backport PR #35592, Upstream PR #35364, @giorio94)
daemon: Reduce level of socket LB tracing warning (Backport PR #35908, Upstream PR #35798, @pchaigno)
datapath: move policy map value prefix length to flags (Backport PR #35603, Upstream PR #35534, @jrajahalme)
dnsproxy: fix error when sessionUDPFactory fails (Backport PR #35543, Upstream PR #33998, @marseel)
docs/ipsec: Remove KPR limitation (Backport PR #35908, Upstream PR #35743, @pchaigno)
docs/xfrm: Fix incorrect statement regarding XFRM IN policies (Backport PR #35781, Upstream PR #35626, @pchaigno)
docs: Change invalid Helm option --agent.enabled with --agent=false in upgrade documentation (Backport PR #35319, Upstream PR #35288, @oneumyvakin)
docs: clean up stale kernel requirements (Backport PR #35582, Upstream PR #35575, @julianwiedmann)
docs: Fix incorrect link to RFC 4271 for BGP control plane timers. (Backport PR #35781, Upstream PR #35725, @nvibert)
docs: kpr: update error message regarding SocketLB tracing (Backport PR #35468, Upstream PR #35337, @julianwiedmann)
docs: tuning: XDP LB also supports tunnel routing (Backport PR #35582, Upstream PR #35574, @julianwiedmann)
docs: update 1.16 upgrade note for LRP (#35944, @ysksuzuki)
docs: update default identity label filters (Backport PR #35468, Upstream PR #35422, @marseel)
docs: XFRM reference guide for IPsec development (Backport PR #35582, Upstream PR #35322, @pchaigno)
Envoy simplify listener setup (Backport PR #35764, Upstream PR #35642, @jrajahalme)
envoy: Configure internal_address_config to avoid warning log (Backport PR #35471, Upstream PR #35090, @sayboras)
envoy: Limit started serving logging to the typeURL of the stream (Backport PR #35781, Upstream PR #35736, @jrajahalme)
Fix wrongly spelled config option in error message (Backport PR #35543, Upstream PR #35390, @baurmatt)
helm: clarify text for serviceNoBackendResponse (Backport PR #35908, Upstream PR #35734, @julianwiedmann)
hubble: Add 'release' Make target (Backport PR #35781, Upstream PR #35561, @michi-covalent)
image: Use cilium-builder instead of golang as operator builder image (Backport PR #35781, Upstream PR #35351, @learnitall)
iptables: always warn about missing xt_socket module (Backport PR #35781, Upstream PR #35591, @julianwiedmann)
makefile: add target to install Cilium in kvstore mode (Backport PR #35905, Upstream PR #35646, @giorio94)
proxy: Ensure proxy ports are written on shutdown (Backport PR #35908, Upstream PR #35839, @jrajahalme)
Silence spurious clustermesh-related warnings (Backport PR #35850, Upstream PR #35867, @giorio94)

Other Changes:

v1.16] envoy: Add configuration for OverloadManager ([#&#8203;35787](https://github.com/cilium/cilium/issues/35787), [@&#8203;sayboras](https://github.com/sayboras))

v1.16] envoy: Bump envoy version from 1.29.x to 1.30.x ([#&#8203;35563](https://github.com/cilium/cilium/issues/35563), [@&#8203;sayboras](https://github.com/sayboras))

v1.16] policy/correlation: Fix `PolicyMatch{L3Proto,L4Only}` case ([#&#8203;35681](https://github.com/cilium/cilium/issues/35681), [@&#8203;gandro](https://github.com/gandro))

chore(deps): update cilium-envoy dependency (#35920, @sayboras)
install: Update image digests for v1.16.3 (#35361, @cilium-release-bot[bot])
Policy add deny rule test and benchmark (#35714, @jrajahalme)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.4@sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf
quay.io/cilium/cilium:stable@sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.4@sha256:b41ba9c1b32e31308e17287a24a5b8e8ed0931f70d168087001c9679bc6c5dd2
quay.io/cilium/clustermesh-apiserver:stable@sha256:b41ba9c1b32e31308e17287a24a5b8e8ed0931f70d168087001c9679bc6c5dd2

docker-plugin

quay.io/cilium/docker-plugin:v1.16.4@sha256:0e55f80fa875a1bcce87d87eae9a72b32c9db1fe9741c1f8d1bf308ef4b1193e
quay.io/cilium/docker-plugin:stable@sha256:0e55f80fa875a1bcce87d87eae9a72b32c9db1fe9741c1f8d1bf308ef4b1193e

hubble-relay

quay.io/cilium/hubble-relay:v1.16.4@sha256:fb2c7d127a1c809f6ba23c05973f3dd00f6b6a48e4aee2da95db925a4f0351d2
quay.io/cilium/hubble-relay:stable@sha256:fb2c7d127a1c809f6ba23c05973f3dd00f6b6a48e4aee2da95db925a4f0351d2

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.4@sha256:8d59d1c9043d0ccf40f3e16361e5c81e8044cb83695d32d750b0c352f690c686
quay.io/cilium/operator-alibabacloud:stable@sha256:8d59d1c9043d0ccf40f3e16361e5c81e8044cb83695d32d750b0c352f690c686

operator-aws

quay.io/cilium/operator-aws:v1.16.4@sha256:355051bbebab73ea3067bb7f0c28cfd43b584d127570cb826f794f468e2d31be
quay.io/cilium/operator-aws:stable@sha256:355051bbebab73ea3067bb7f0c28cfd43b584d127570cb826f794f468e2d31be

operator-azure

quay.io/cilium/operator-azure:v1.16.4@sha256:475594628af6d6a807d58fcb6b7d48f5a82e0289f54ae372972b1d0536c0b6de
quay.io/cilium/operator-azure:stable@sha256:475594628af6d6a807d58fcb6b7d48f5a82e0289f54ae372972b1d0536c0b6de

operator-generic

quay.io/cilium/operator-generic:v1.16.4@sha256:c55a7cbe19fe0b6b28903a085334edb586a3201add9db56d2122c8485f7a51c5
quay.io/cilium/operator-generic:stable@sha256:c55a7cbe19fe0b6b28903a085334edb586a3201add9db56d2122c8485f7a51c5

operator

quay.io/cilium/operator:v1.16.4@sha256:c77643984bc17e1a93d83b58fa976d7e72ad1485ce722257594f8596899fdfff
quay.io/cilium/operator:stable@sha256:c77643984bc17e1a93d83b58fa976d7e72ad1485ce722257594f8596899fdfff

metallb/metallb (metallb)

`v0.14.9`

Compare Source

See the release notes for the details

https://metallb.universe.tf/release-notes/#version-0-14-9

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.16.3` -> `1.16.5` | | [metallb](https://metallb.universe.tf) ([source](https://github.com/metallb/metallb)) | patch | `0.14.8` -> `0.14.9` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.16.5`](https://github.com/cilium/cilium/releases/tag/v1.16.5): 1.16.5 [Compare Source](https://github.com/cilium/cilium/compare/1.16.4...1.16.5) ## Summary of Changes **Minor Changes:** - hubble: Stop building 32-bit binaries (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35974](https://github.com/cilium/cilium/issues/35974), [@michi-covalent](https://github.com/michi-covalent)) **Bugfixes:** - Address potential connectivity disruption when using either L7 / DNS Network policies in combination with per-endpoint routes and hostLegacyRouting, or L7 / DNS network policies in combination with IPsec network encryption. (Backport PR [#36540](https://github.com/cilium/cilium/issues/36540), Upstream PR [#36484](https://github.com/cilium/cilium/issues/36484), [@julianwiedmann](https://github.com/julianwiedmann)) - bgp: fix race in bgp stores (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35971](https://github.com/cilium/cilium/issues/35971), [@harsimran-pabla](https://github.com/harsimran-pabla)) - BGPv1: Fix race by reconciliation of services with externalTrafficPolicy=Local by populating locally available services after performing service diff (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36230](https://github.com/cilium/cilium/issues/36230), [@rastislavs](https://github.com/rastislavs)) - BGPv2: Fix race by reconciliation of services with externalTrafficPolicy=Local by populating locally available services after performing service diff (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36165](https://github.com/cilium/cilium/issues/36165), [@rastislavs](https://github.com/rastislavs)) - Cilium agent now waits until endpoints have restored before starting accepting new xDS streams. (Backport PR [#36049](https://github.com/cilium/cilium/issues/36049), Upstream PR [#35984](https://github.com/cilium/cilium/issues/35984), [@jrajahalme](https://github.com/jrajahalme)) - Cilium no longer keeps old DNS-IP mappings alive while reaping newer ones, leading to spurious drops in connections to domains with many IPs associated. (Backport PR [#36462](https://github.com/cilium/cilium/issues/36462), Upstream PR [#36252](https://github.com/cilium/cilium/issues/36252), [@bimmlerd](https://github.com/bimmlerd)) - cilium-health-ep controller is made to be more robust against successive failures. (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35936](https://github.com/cilium/cilium/issues/35936), [@jrajahalme](https://github.com/jrajahalme)) - DNS proxy port is no longer released when endpoint with a DNS policy fails to regenerate successfully. A potential deadlock between CEC/CCEC parser and endpoint policy update is removed. (Backport PR [#36468](https://github.com/cilium/cilium/issues/36468), Upstream PR [#36142](https://github.com/cilium/cilium/issues/36142), [@jrajahalme](https://github.com/jrajahalme)) - Envoy "initial fetch timeout" warnings are now demoted to info level, as they are expected to happen during Cilium Agent restart. (Backport PR [#36049](https://github.com/cilium/cilium/issues/36049), Upstream PR [#36060](https://github.com/cilium/cilium/issues/36060), [@jrajahalme](https://github.com/jrajahalme)) - Fix an issue where pod-to-world traffic goes up stack when BPF host routing is enabled with tunnel. (Backport PR [#35861](https://github.com/cilium/cilium/issues/35861), Upstream PR [#35098](https://github.com/cilium/cilium/issues/35098), [@jschwinger233](https://github.com/jschwinger233)) - Fix identity leak for kvstore identity mode (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#34893](https://github.com/cilium/cilium/issues/34893), [@odinuge](https://github.com/odinuge)) - Fix potential Cilium agent panic during endpoint restoration, occurring if the corresponding pod gets deleted while the agent is restarting. This regression only affects Cilium v1.16.4. (Backport PR [#36302](https://github.com/cilium/cilium/issues/36302), Upstream PR [#36292](https://github.com/cilium/cilium/issues/36292), [@giorio94](https://github.com/giorio94)) - gateway-api: Fix gateway checks for namespace (Backport PR [#36462](https://github.com/cilium/cilium/issues/36462), Upstream PR [#35452](https://github.com/cilium/cilium/issues/35452), [@sayboras](https://github.com/sayboras)) - gha: Remove hostLegacyRouting in clustermesh (Backport PR [#36357](https://github.com/cilium/cilium/issues/36357), Upstream PR [#35418](https://github.com/cilium/cilium/issues/35418), [@sayboras](https://github.com/sayboras)) - helm: Use an absolute FQDN for the Hubble peer-service endpoint to avoid incorrect DNS resolution outside the cluster (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#36005](https://github.com/cilium/cilium/issues/36005), [@devodev](https://github.com/devodev)) - hubble: consistently use v as prefix for the Hubble version (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#35891](https://github.com/cilium/cilium/issues/35891), [@rolinh](https://github.com/rolinh)) - iptables: Fix data race in iptables manager (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35902](https://github.com/cilium/cilium/issues/35902), [@pippolo84](https://github.com/pippolo84)) - lrp: update LRP services with stale backends on agent restart (Backport PR [#36106](https://github.com/cilium/cilium/issues/36106), Upstream PR [#36036](https://github.com/cilium/cilium/issues/36036), [@ysksuzuki](https://github.com/ysksuzuki)) - policy: Fix bug that allowed port ranges to be attached to L7 policies, which is not permitted. ([#36050](https://github.com/cilium/cilium/issues/36050), [@nathanjsweet](https://github.com/nathanjsweet)) - Unbreak the cilium-dbg preflight migrate-identity command (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36089](https://github.com/cilium/cilium/issues/36089), [@giorio94](https://github.com/giorio94)) - Use `strconv.Itoa` instead of `string()` for the correct behavior when converting `kafka.ErrorCode` from `int32` to `string`. Add relevant unit tests for Kafka plugin and handler. (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35856](https://github.com/cilium/cilium/issues/35856), [@nddq](https://github.com/nddq)) **CI Changes:** - \[v1.16] ci: modularize chart CI push workflow ([#35958](https://github.com/cilium/cilium/issues/35958), [@ferozsalam](https://github.com/ferozsalam)) - gh: conformance-clustermesh: test with IPsec + BPF NodePort (Backport PR [#36462](https://github.com/cilium/cilium/issues/36462), Upstream PR [#36384](https://github.com/cilium/cilium/issues/36384), [@julianwiedmann](https://github.com/julianwiedmann)) - gha: configure environment in build-images-base/image-digests job (Backport PR [#36462](https://github.com/cilium/cilium/issues/36462), Upstream PR [#36318](https://github.com/cilium/cilium/issues/36318), [@giorio94](https://github.com/giorio94)) - node_local_store: prevent racey tests while using mock node store. (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35945](https://github.com/cilium/cilium/issues/35945), [@tommyp1ckles](https://github.com/tommyp1ckles)) - Remove unnecessary hubble port-forward commands (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#33523](https://github.com/cilium/cilium/issues/33523), [@michi-covalent](https://github.com/michi-covalent)) **Misc Changes:** - \[v1.16] docs: egress masquerade selector ([#36333](https://github.com/cilium/cilium/issues/36333), [@viktor-kurchenko](https://github.com/viktor-kurchenko)) - \[v1.16] images: bump cni plugins to v1.6.0 ([#36092](https://github.com/cilium/cilium/issues/36092), [@ferozsalam](https://github.com/ferozsalam)) - bugtool: dump tail-call map for bpf_wireguard (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36183](https://github.com/cilium/cilium/issues/36183), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.16) ([#36155](https://github.com/cilium/cilium/issues/36155), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.16) ([#36275](https://github.com/cilium/cilium/issues/36275), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.16) ([#36443](https://github.com/cilium/cilium/issues/36443), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.16) (patch) ([#36277](https://github.com/cilium/cilium/issues/36277), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.16) ([#35546](https://github.com/cilium/cilium/issues/35546), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.16) ([#36152](https://github.com/cilium/cilium/issues/36152), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.16) ([#36279](https://github.com/cilium/cilium/issues/36279), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.16) ([#36444](https://github.com/cilium/cilium/issues/36444), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/little-vm-helper action to v0.0.19 (v1.16) ([#36153](https://github.com/cilium/cilium/issues/36153), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.22.9 docker digest to [`147f428`](https://github.com/cilium/cilium/commit/147f428) (v1.16) ([#36222](https://github.com/cilium/cilium/issues/36222), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update go to v1.22.10 (v1.16) ([#36441](https://github.com/cilium/cilium/issues/36441), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.7-1732605705-2aa20ee3acb68cd38d57669af19508bea8f0ba62 (v1.16) ([#36180](https://github.com/cilium/cilium/issues/36180), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8 (v1.16) ([#36495](https://github.com/cilium/cilium/issues/36495), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20241129.013349 (v1.16) ([#36278](https://github.com/cilium/cilium/issues/36278), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20241206.013345 (v1.16) ([#36442](https://github.com/cilium/cilium/issues/36442), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.16) (patch) ([#36154](https://github.com/cilium/cilium/issues/36154), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - docs: Add the tls:// prefix before the IP address (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36118](https://github.com/cilium/cilium/issues/36118), [@liyihuang](https://github.com/liyihuang)) - docs: Fix typo in multi-pool section title (Backport PR [#36312](https://github.com/cilium/cilium/issues/36312), Upstream PR [#36305](https://github.com/cilium/cilium/issues/36305), [@joestringer](https://github.com/joestringer)) - docs: In k0s guide, remove dashes to fix invalid Bash variable names. (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35923](https://github.com/cilium/cilium/issues/35923), [@yilas](https://github.com/yilas)) - docs: lrp: fix kernel version requirement for skipRedirectFromBackend (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35921](https://github.com/cilium/cilium/issues/35921), [@ysksuzuki](https://github.com/ysksuzuki)) - docs: system-requirements: require 5.4 kernel (Backport PR [#36462](https://github.com/cilium/cilium/issues/36462), Upstream PR [#36386](https://github.com/cilium/cilium/issues/36386), [@julianwiedmann](https://github.com/julianwiedmann)) - docs: WireGuard doesn't require overlay port in Network Firewalls (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36208](https://github.com/cilium/cilium/issues/36208), [@julianwiedmann](https://github.com/julianwiedmann)) - Endpoint populate new policymap early if empty (Backport PR [#36479](https://github.com/cilium/cilium/issues/36479), Upstream PR [#36361](https://github.com/cilium/cilium/issues/36361), [@jrajahalme](https://github.com/jrajahalme)) - envoy: Configure internal_address_config to avoid warning log (Backport PR [#36015](https://github.com/cilium/cilium/issues/36015), Upstream PR [#35943](https://github.com/cilium/cilium/issues/35943), [@sayboras](https://github.com/sayboras)) - envoy: Pass tofqdns-proxy-response-max-delay to Envoy (Backport PR [#36468](https://github.com/cilium/cilium/issues/36468), Upstream PR [#36330](https://github.com/cilium/cilium/issues/36330), [@jrajahalme](https://github.com/jrajahalme)) - fix(deps): update module golang.org/x/crypto to v0.31.0 \[security] (v1.16) ([#36530](https://github.com/cilium/cilium/issues/36530), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed BGP documentation (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35953](https://github.com/cilium/cilium/issues/35953), [@seadog007](https://github.com/seadog007)) - images: Use cilium-builder image instead of golang to build hubble (Backport PR [#36312](https://github.com/cilium/cilium/issues/36312), Upstream PR [#35697](https://github.com/cilium/cilium/issues/35697), [@learnitall](https://github.com/learnitall)) - lrp: fix kernel version requirement in warning log (Backport PR [#36286](https://github.com/cilium/cilium/issues/36286), Upstream PR [#36141](https://github.com/cilium/cilium/issues/36141), [@ysksuzuki](https://github.com/ysksuzuki)) - Makefile: fix swagger definition for automatic renovate updates (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35979](https://github.com/cilium/cilium/issues/35979), [@aanm](https://github.com/aanm)) - proxy: Take proxy port reference for new redirects immediately (Backport PR [#36468](https://github.com/cilium/cilium/issues/36468), Upstream PR [#36435](https://github.com/cilium/cilium/issues/36435), [@jrajahalme](https://github.com/jrajahalme)) - proxyports: Resolve data races in test (Backport PR [#36468](https://github.com/cilium/cilium/issues/36468), Upstream PR [#36399](https://github.com/cilium/cilium/issues/36399), [@jrajahalme](https://github.com/jrajahalme)) - proxyports: Sleep a bit longer in tests (Backport PR [#36468](https://github.com/cilium/cilium/issues/36468), Upstream PR [#36389](https://github.com/cilium/cilium/issues/36389), [@jrajahalme](https://github.com/jrajahalme)) - Remove duplicated watch on services and endpoint in the cilium-agent (Backport PR [#36066](https://github.com/cilium/cilium/issues/36066), Upstream PR [#35838](https://github.com/cilium/cilium/issues/35838), [@MrFreezeex](https://github.com/MrFreezeex)) - Rework error handling logic in neighbor discovery (Backport PR [#36093](https://github.com/cilium/cilium/issues/36093), Upstream PR [#35144](https://github.com/cilium/cilium/issues/35144), [@pippolo84](https://github.com/pippolo84)) - Silence spurious clustermesh-related warnings (Backport PR [#36225](https://github.com/cilium/cilium/issues/36225), Upstream PR [#35867](https://github.com/cilium/cilium/issues/35867), [@giorio94](https://github.com/giorio94)) - Update documentation for egress masquerading behavior (Backport PR [#36462](https://github.com/cilium/cilium/issues/36462), Upstream PR [#36267](https://github.com/cilium/cilium/issues/36267), [@liyihuang](https://github.com/liyihuang)) **Other Changes:** - \[1.16] ci/ipsec-upgrade: increase cilium status wait duration ([#36082](https://github.com/cilium/cilium/issues/36082), [@harsimran-pabla](https://github.com/harsimran-pabla)) - \[v1.16] cilium, service: Fix checkLBSrcRange propagation to LB map ([#36511](https://github.com/cilium/cilium/issues/36511), [@borkmann](https://github.com/borkmann)) - install: Update image digests for v1.16.4 ([#36047](https://github.com/cilium/cilium/issues/36047), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - jrajahalme/v1.16 cilium cli ([#36541](https://github.com/cilium/cilium/issues/36541), [@jrajahalme](https://github.com/jrajahalme)) - Revert "workflows/ipsec: Cover Ingress" ([#36116](https://github.com/cilium/cilium/issues/36116), [@harsimran-pabla](https://github.com/harsimran-pabla)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.16.5@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d` `quay.io/cilium/cilium:stable@sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.16.5@sha256:37a7fdbef806b78ef63df9f1a9828fdddbf548d1f0e43b8eb10a6bdc8fa03958` `quay.io/cilium/clustermesh-apiserver:stable@sha256:37a7fdbef806b78ef63df9f1a9828fdddbf548d1f0e43b8eb10a6bdc8fa03958` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.16.5@sha256:d6b4ed076ae921535c2a543d4b5b63af474288ee4501653a1f442c935beb5768` `quay.io/cilium/docker-plugin:stable@sha256:d6b4ed076ae921535c2a543d4b5b63af474288ee4501653a1f442c935beb5768` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.16.5@sha256:6cfae1d1afa566ba941f03d4d7e141feddd05260e5cd0a1509aba1890a45ef00` `quay.io/cilium/hubble-relay:stable@sha256:6cfae1d1afa566ba941f03d4d7e141feddd05260e5cd0a1509aba1890a45ef00` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.16.5@sha256:c0edf4c8d089e76d6565d3c57128b98bc6c73d14bb4590126ee746aeaedba5e0` `quay.io/cilium/operator-alibabacloud:stable@sha256:c0edf4c8d089e76d6565d3c57128b98bc6c73d14bb4590126ee746aeaedba5e0` ##### operator-aws `quay.io/cilium/operator-aws:v1.16.5@sha256:97e1fe0c2b522583033138eb10c170919d8de49d2788ceefdcff229a92210476` `quay.io/cilium/operator-aws:stable@sha256:97e1fe0c2b522583033138eb10c170919d8de49d2788ceefdcff229a92210476` ##### operator-azure `quay.io/cilium/operator-azure:v1.16.5@sha256:265e2b78f572c76b523f91757083ea5f0b9b73b82f2d9714e5a8fb848e4048f9` `quay.io/cilium/operator-azure:stable@sha256:265e2b78f572c76b523f91757083ea5f0b9b73b82f2d9714e5a8fb848e4048f9` ##### operator-generic `quay.io/cilium/operator-generic:v1.16.5@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039` `quay.io/cilium/operator-generic:stable@sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039` ##### operator `quay.io/cilium/operator:v1.16.5@sha256:617896e1b23a2c4504ab2c84f17964e24dade3b5845f733b11847202230ca940` `quay.io/cilium/operator:stable@sha256:617896e1b23a2c4504ab2c84f17964e24dade3b5845f733b11847202230ca940` ### [`v1.16.4`](https://github.com/cilium/cilium/releases/tag/v1.16.4): 1.16.4 [Compare Source](https://github.com/cilium/cilium/compare/1.16.3...1.16.4) ## Security Advisories This release addresses https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67. ## Summary of Changes **Minor Changes:** - Added Helm option 'envoy.initialFetchTimeoutSeconds' (default 30 seconds) to override the Envoy default (15 seconds). (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35809](https://github.com/cilium/cilium/issues/35809), [@jrajahalme](https://github.com/jrajahalme)) - clustermesh: add guardrails for known broken ENI/aws-chaining + cluster ID combination (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#35349](https://github.com/cilium/cilium/issues/35349), [@giorio94](https://github.com/giorio94)) - helm: Lower default `hubble.tls.auto.certValidityDuration` to 365 days (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35630](https://github.com/cilium/cilium/issues/35630), [@chancez](https://github.com/chancez)) - helm: New socketLB.tracing flag (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35747](https://github.com/cilium/cilium/issues/35747), [@pchaigno](https://github.com/pchaigno)) - hubble-relay: Return underlying connection errors when connecting to peer manager (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35632](https://github.com/cilium/cilium/issues/35632), [@chancez](https://github.com/chancez)) - netkit: Fix issue where traffic originating from the host namespace fails to reach the pod when using endpoint routes and network policies. (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#35306](https://github.com/cilium/cilium/issues/35306), [@jrife](https://github.com/jrife)) **Bugfixes:** - Avoid duplicate errors in health status for node-neighbor-link-updater (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35179](https://github.com/cilium/cilium/issues/35179), [@wedaly](https://github.com/wedaly)) - bgpv1: fix reconciliation of services with shared VIPs (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35333](https://github.com/cilium/cilium/issues/35333), [@rastislavs](https://github.com/rastislavs)) - bgpv2,operator: Fix the race condition in the nodeSelector conflict detection logic (Backport PR [#35863](https://github.com/cilium/cilium/issues/35863), Upstream PR [#35690](https://github.com/cilium/cilium/issues/35690), [@YutaroHayakawa](https://github.com/YutaroHayakawa)) - bgpv2: set local peering address when specified (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35552](https://github.com/cilium/cilium/issues/35552), [@harsimran-pabla](https://github.com/harsimran-pabla)) - Cilium datapath now gives precedence for the more specific allow rule with L7 rules when rules with port ranges are present. (Backport PR [#35603](https://github.com/cilium/cilium/issues/35603), Upstream PR [#35150](https://github.com/cilium/cilium/issues/35150), [@jrajahalme](https://github.com/jrajahalme)) - Cilium's DNS proxy no longer gets stuck for a specific five-tuple if an `timeout waiting for response` error is encountered. (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35589](https://github.com/cilium/cilium/issues/35589), [@bimmlerd](https://github.com/bimmlerd)) - config: Remove superfluous warning on native routing CIDR (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35738](https://github.com/cilium/cilium/issues/35738), [@gandro](https://github.com/gandro)) - Fix missing flowlabel hash on SRv6 traffic. (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35498](https://github.com/cilium/cilium/issues/35498), [@akaliwod](https://github.com/akaliwod)) - Fix packet drops for pod-to-pod connections that pass through ingress & egress proxy when using IPsec, caused by MTU misconfiguration. (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#35173](https://github.com/cilium/cilium/issues/35173), [@smagnani96](https://github.com/smagnani96)) - Fix possible disruption of long running pod to node traffic on agent restart in kvstore mode (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35673](https://github.com/cilium/cilium/issues/35673), [@giorio94](https://github.com/giorio94)) - Fix redirect from L3 device to remote endpoint via overlay network. (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35165](https://github.com/cilium/cilium/issues/35165), [@julianwiedmann](https://github.com/julianwiedmann)) - Fixed a bug where replies for pod-originating connections came into scope of HostFW Ingress Network policy. Applicable to configurations that use iptables for Masquerading. (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35694](https://github.com/cilium/cilium/issues/35694), [@julianwiedmann](https://github.com/julianwiedmann)) - Fixes a bug where the operator incorrectly flagged CiliumNetworkPolicies containing ICMP rules as invalid. (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35599](https://github.com/cilium/cilium/issues/35599), [@squeed](https://github.com/squeed)) - Fixes a performance regression when ingesting network policies in clusters with large numbers of Services. (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#35293](https://github.com/cilium/cilium/issues/35293), [@squeed](https://github.com/squeed)) - Fixes a potential deadlock when restarting cilium agent with pods with DNS interception configured (Backport PR [#35906](https://github.com/cilium/cilium/issues/35906), Upstream PR [#35890](https://github.com/cilium/cilium/issues/35890), [@squeed](https://github.com/squeed)) - Fixes BPF Masquerading exclusion CIDR for IPAM modes "eni", "azure" and "alibabacloud". ([#35611](https://github.com/cilium/cilium/issues/35611), [@pippolo84](https://github.com/pippolo84)) - helm: Fix configmap unmarshal error on egressGateway.maxPolicyEntries (Backport PR [#35319](https://github.com/cilium/cilium/issues/35319), Upstream PR [#35301](https://github.com/cilium/cilium/issues/35301), [@hox](https://github.com/hox)) - helm: fix duplicate configmap key for `bpf-lb-sock-terminate-pod-connections` (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35703](https://github.com/cilium/cilium/issues/35703), [@solidDoWant](https://github.com/solidDoWant)) - helm: set automountServiceAccountToken to false for hubble-relay sa (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35674](https://github.com/cilium/cilium/issues/35674), [@ayuspin](https://github.com/ayuspin)) - hubble: fix endpoint cluster name (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35415](https://github.com/cilium/cilium/issues/35415), [@kaworu](https://github.com/kaworu)) - hubble: Lock exporters while gathering metrics (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35860](https://github.com/cilium/cilium/issues/35860), [@joestringer](https://github.com/joestringer)) - Ingress endpoint is now included in the lxcmap so that ARP and ND6 work for them. (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35143](https://github.com/cilium/cilium/issues/35143), [@jrajahalme](https://github.com/jrajahalme)) - ipam: Validate CiliumNode resource in ENI mode (Backport PR [#35792](https://github.com/cilium/cilium/issues/35792), Upstream PR [#35784](https://github.com/cilium/cilium/issues/35784), [@sayboras](https://github.com/sayboras)) - l7lb: fix registration of flag loadbalancer-l7 (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35623](https://github.com/cilium/cilium/issues/35623), [@mhofstetter](https://github.com/mhofstetter)) - Log errors when reloading hubble exporter configuration dynamically and do not attempt to close os.Stdout (Backport PR [#35319](https://github.com/cilium/cilium/issues/35319), Upstream PR [#35069](https://github.com/cilium/cilium/issues/35069), [@chancez](https://github.com/chancez)) - option: Reduce log level for WG strict mode + IPv6 (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35763](https://github.com/cilium/cilium/issues/35763), [@pchaigno](https://github.com/pchaigno)) - Policy properly propagates proxy listener name and priority from a L3 wildcard rule with policies requiring authentication. (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35381](https://github.com/cilium/cilium/issues/35381), [@jrajahalme](https://github.com/jrajahalme)) - treewide: Add wrapper for `netlink` functions that may fail with `ErrDumpInterrupted` (Backport PR [#35654](https://github.com/cilium/cilium/issues/35654), Upstream PR [#35614](https://github.com/cilium/cilium/issues/35614), [@gandro](https://github.com/gandro)) - wireguard: Fix connectivity issues following node reboots. (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35750](https://github.com/cilium/cilium/issues/35750), [@jrife](https://github.com/jrife)) **CI Changes:** - .github/conformance-ginkgo: replace deprecated jq flag (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35399](https://github.com/cilium/cilium/issues/35399), [@aanm](https://github.com/aanm)) - .github: extend timeout for tests-ipsec-upgrade workflow (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35657](https://github.com/cilium/cilium/issues/35657), [@rastislavs](https://github.com/rastislavs)) - .github: remove libncurses5 from integration tests (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35408](https://github.com/cilium/cilium/issues/35408), [@aanm](https://github.com/aanm)) - \[v1.16] gh: e2e-upgrade: restart LRP backend pod after upgrade ([#35329](https://github.com/cilium/cilium/issues/35329), [@ysksuzuki](https://github.com/ysksuzuki)) - \[v1.16] github: update rhel8 LVH image to rhel8.6 ([#35733](https://github.com/cilium/cilium/issues/35733), [@julianwiedmann](https://github.com/julianwiedmann)) - Additionally test KVStore mode in E2E/IPSec workflows (Backport PR [#35905](https://github.com/cilium/cilium/issues/35905), Upstream PR [#35679](https://github.com/cilium/cilium/issues/35679), [@giorio94](https://github.com/giorio94)) - ci: conformance-kind: re-enable flaky Aggregator test (Backport PR [#35582](https://github.com/cilium/cilium/issues/35582), Upstream PR [#35286](https://github.com/cilium/cilium/issues/35286), [@julianwiedmann](https://github.com/julianwiedmann)) - ci: datapath-verifier: bump lvh images (Backport PR [#35648](https://github.com/cilium/cilium/issues/35648), Upstream PR [#35456](https://github.com/cilium/cilium/issues/35456), [@julianwiedmann](https://github.com/julianwiedmann)) - gha: Update chmod command (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35400](https://github.com/cilium/cilium/issues/35400), [@sayboras](https://github.com/sayboras)) - github: Pass the workflow step timeout to go test (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35814](https://github.com/cilium/cilium/issues/35814), [@jrajahalme](https://github.com/jrajahalme)) - Refactor and set a default for GH_RUNNER_EXTRA_POWER (Backport PR [#35319](https://github.com/cilium/cilium/issues/35319), Upstream PR [#35267](https://github.com/cilium/cilium/issues/35267), [@aanm](https://github.com/aanm)) - workflows/gateway-api: Cover IPsec with GatewayAPI (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35584](https://github.com/cilium/cilium/issues/35584), [@pchaigno](https://github.com/pchaigno)) - workflows/ingress: Run basic checks (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35683](https://github.com/cilium/cilium/issues/35683), [@pchaigno](https://github.com/pchaigno)) - workflows/ipsec: Cover Ingress (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35476](https://github.com/cilium/cilium/issues/35476), [@pchaigno](https://github.com/pchaigno)) - workflows: Extend IPsec tests to cover egress gateway (Backport PR [#35540](https://github.com/cilium/cilium/issues/35540), Upstream PR [#35323](https://github.com/cilium/cilium/issues/35323), [@pchaigno](https://github.com/pchaigno)) **Misc Changes:** - .github/build-images-base: checkout base branch to get scripts (Backport PR [#35319](https://github.com/cilium/cilium/issues/35319), Upstream PR [#35236](https://github.com/cilium/cilium/issues/35236), [@aanm](https://github.com/aanm)) - .github: remove retention days for image digests (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35457](https://github.com/cilium/cilium/issues/35457), [@aanm](https://github.com/aanm)) - bpf: vxlan helper improvements (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#34755](https://github.com/cilium/cilium/issues/34755), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.16) ([#35382](https://github.com/cilium/cilium/issues/35382), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.16) ([#35439](https://github.com/cilium/cilium/issues/35439), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.16) ([#35573](https://github.com/cilium/cilium/issues/35573), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.16) ([#35710](https://github.com/cilium/cilium/issues/35710), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.16) ([#35438](https://github.com/cilium/cilium/issues/35438), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.22.8 docker digest to [`0ca97f4`](https://github.com/cilium/cilium/commit/0ca97f4) (v1.16) ([#35730](https://github.com/cilium/cilium/issues/35730), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.22.8 docker digest to [`b274ff1`](https://github.com/cilium/cilium/commit/b274ff1) (v1.16) ([#35379](https://github.com/cilium/cilium/issues/35379), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update go to v1.22.9 (v1.16) ([#35854](https://github.com/cilium/cilium/issues/35854), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1729635771-fa4efeff33a344a45e14a4068c61dc438b3d2270 (v1.16) ([#35491](https://github.com/cilium/cilium/issues/35491), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.16) (patch) ([#35731](https://github.com/cilium/cilium/issues/35731), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - cilium, docs: Extend requirements for L7 proxy (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35669](https://github.com/cilium/cilium/issues/35669), [@borkmann](https://github.com/borkmann)) - cilium: add probe for netkit for more user friendly error when not supported (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35551](https://github.com/cilium/cilium/issues/35551), [@borkmann](https://github.com/borkmann)) - ctrl-runtime: lower severity of retryable reconcile errors (Backport PR [#35592](https://github.com/cilium/cilium/issues/35592), Upstream PR [#35364](https://github.com/cilium/cilium/issues/35364), [@giorio94](https://github.com/giorio94)) - daemon: Reduce level of socket LB tracing warning (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35798](https://github.com/cilium/cilium/issues/35798), [@pchaigno](https://github.com/pchaigno)) - datapath: move policy map value prefix length to flags (Backport PR [#35603](https://github.com/cilium/cilium/issues/35603), Upstream PR [#35534](https://github.com/cilium/cilium/issues/35534), [@jrajahalme](https://github.com/jrajahalme)) - dnsproxy: fix error when sessionUDPFactory fails (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#33998](https://github.com/cilium/cilium/issues/33998), [@marseel](https://github.com/marseel)) - docs/ipsec: Remove KPR limitation (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35743](https://github.com/cilium/cilium/issues/35743), [@pchaigno](https://github.com/pchaigno)) - docs/xfrm: Fix incorrect statement regarding XFRM IN policies (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35626](https://github.com/cilium/cilium/issues/35626), [@pchaigno](https://github.com/pchaigno)) - docs: Change invalid Helm option --agent.enabled with --agent=false in upgrade documentation (Backport PR [#35319](https://github.com/cilium/cilium/issues/35319), Upstream PR [#35288](https://github.com/cilium/cilium/issues/35288), [@oneumyvakin](https://github.com/oneumyvakin)) - docs: clean up stale kernel requirements (Backport PR [#35582](https://github.com/cilium/cilium/issues/35582), Upstream PR [#35575](https://github.com/cilium/cilium/issues/35575), [@julianwiedmann](https://github.com/julianwiedmann)) - docs: Fix incorrect link to RFC 4271 for BGP control plane timers. (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35725](https://github.com/cilium/cilium/issues/35725), [@nvibert](https://github.com/nvibert)) - docs: kpr: update error message regarding SocketLB tracing (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35337](https://github.com/cilium/cilium/issues/35337), [@julianwiedmann](https://github.com/julianwiedmann)) - docs: tuning: XDP LB also supports tunnel routing (Backport PR [#35582](https://github.com/cilium/cilium/issues/35582), Upstream PR [#35574](https://github.com/cilium/cilium/issues/35574), [@julianwiedmann](https://github.com/julianwiedmann)) - docs: update 1.16 upgrade note for LRP ([#35944](https://github.com/cilium/cilium/issues/35944), [@ysksuzuki](https://github.com/ysksuzuki)) - docs: update default identity label filters (Backport PR [#35468](https://github.com/cilium/cilium/issues/35468), Upstream PR [#35422](https://github.com/cilium/cilium/issues/35422), [@marseel](https://github.com/marseel)) - docs: XFRM reference guide for IPsec development (Backport PR [#35582](https://github.com/cilium/cilium/issues/35582), Upstream PR [#35322](https://github.com/cilium/cilium/issues/35322), [@pchaigno](https://github.com/pchaigno)) - Envoy simplify listener setup (Backport PR [#35764](https://github.com/cilium/cilium/issues/35764), Upstream PR [#35642](https://github.com/cilium/cilium/issues/35642), [@jrajahalme](https://github.com/jrajahalme)) - envoy: Configure internal_address_config to avoid warning log (Backport PR [#35471](https://github.com/cilium/cilium/issues/35471), Upstream PR [#35090](https://github.com/cilium/cilium/issues/35090), [@sayboras](https://github.com/sayboras)) - envoy: Limit started serving logging to the typeURL of the stream (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35736](https://github.com/cilium/cilium/issues/35736), [@jrajahalme](https://github.com/jrajahalme)) - Fix wrongly spelled config option in error message (Backport PR [#35543](https://github.com/cilium/cilium/issues/35543), Upstream PR [#35390](https://github.com/cilium/cilium/issues/35390), [@baurmatt](https://github.com/baurmatt)) - helm: clarify text for serviceNoBackendResponse (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35734](https://github.com/cilium/cilium/issues/35734), [@julianwiedmann](https://github.com/julianwiedmann)) - hubble: Add 'release' Make target (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35561](https://github.com/cilium/cilium/issues/35561), [@michi-covalent](https://github.com/michi-covalent)) - image: Use cilium-builder instead of golang as operator builder image (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35351](https://github.com/cilium/cilium/issues/35351), [@learnitall](https://github.com/learnitall)) - iptables: always warn about missing xt_socket module (Backport PR [#35781](https://github.com/cilium/cilium/issues/35781), Upstream PR [#35591](https://github.com/cilium/cilium/issues/35591), [@julianwiedmann](https://github.com/julianwiedmann)) - makefile: add target to install Cilium in kvstore mode (Backport PR [#35905](https://github.com/cilium/cilium/issues/35905), Upstream PR [#35646](https://github.com/cilium/cilium/issues/35646), [@giorio94](https://github.com/giorio94)) - proxy: Ensure proxy ports are written on shutdown (Backport PR [#35908](https://github.com/cilium/cilium/issues/35908), Upstream PR [#35839](https://github.com/cilium/cilium/issues/35839), [@jrajahalme](https://github.com/jrajahalme)) - Silence spurious clustermesh-related warnings (Backport PR [#35850](https://github.com/cilium/cilium/issues/35850), Upstream PR [#35867](https://github.com/cilium/cilium/issues/35867), [@giorio94](https://github.com/giorio94)) **Other Changes:** - \[v1.16] envoy: Add configuration for OverloadManager ([#35787](https://github.com/cilium/cilium/issues/35787), [@sayboras](https://github.com/sayboras)) - \[v1.16] envoy: Bump envoy version from 1.29.x to 1.30.x ([#35563](https://github.com/cilium/cilium/issues/35563), [@sayboras](https://github.com/sayboras)) - \[v1.16] policy/correlation: Fix `PolicyMatch{L3Proto,L4Only}` case ([#35681](https://github.com/cilium/cilium/issues/35681), [@gandro](https://github.com/gandro)) - chore(deps): update cilium-envoy dependency ([#35920](https://github.com/cilium/cilium/issues/35920), [@sayboras](https://github.com/sayboras)) - install: Update image digests for v1.16.3 ([#35361](https://github.com/cilium/cilium/issues/35361), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - Policy add deny rule test and benchmark ([#35714](https://github.com/cilium/cilium/issues/35714), [@jrajahalme](https://github.com/jrajahalme)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.16.4@sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf` `quay.io/cilium/cilium:stable@sha256:d55ec38938854133e06739b1af237932b9c4dd4e75e9b7b2ca3acc72540a44bf` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.16.4@sha256:b41ba9c1b32e31308e17287a24a5b8e8ed0931f70d168087001c9679bc6c5dd2` `quay.io/cilium/clustermesh-apiserver:stable@sha256:b41ba9c1b32e31308e17287a24a5b8e8ed0931f70d168087001c9679bc6c5dd2` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.16.4@sha256:0e55f80fa875a1bcce87d87eae9a72b32c9db1fe9741c1f8d1bf308ef4b1193e` `quay.io/cilium/docker-plugin:stable@sha256:0e55f80fa875a1bcce87d87eae9a72b32c9db1fe9741c1f8d1bf308ef4b1193e` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.16.4@sha256:fb2c7d127a1c809f6ba23c05973f3dd00f6b6a48e4aee2da95db925a4f0351d2` `quay.io/cilium/hubble-relay:stable@sha256:fb2c7d127a1c809f6ba23c05973f3dd00f6b6a48e4aee2da95db925a4f0351d2` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.16.4@sha256:8d59d1c9043d0ccf40f3e16361e5c81e8044cb83695d32d750b0c352f690c686` `quay.io/cilium/operator-alibabacloud:stable@sha256:8d59d1c9043d0ccf40f3e16361e5c81e8044cb83695d32d750b0c352f690c686` ##### operator-aws `quay.io/cilium/operator-aws:v1.16.4@sha256:355051bbebab73ea3067bb7f0c28cfd43b584d127570cb826f794f468e2d31be` `quay.io/cilium/operator-aws:stable@sha256:355051bbebab73ea3067bb7f0c28cfd43b584d127570cb826f794f468e2d31be` ##### operator-azure `quay.io/cilium/operator-azure:v1.16.4@sha256:475594628af6d6a807d58fcb6b7d48f5a82e0289f54ae372972b1d0536c0b6de` `quay.io/cilium/operator-azure:stable@sha256:475594628af6d6a807d58fcb6b7d48f5a82e0289f54ae372972b1d0536c0b6de` ##### operator-generic `quay.io/cilium/operator-generic:v1.16.4@sha256:c55a7cbe19fe0b6b28903a085334edb586a3201add9db56d2122c8485f7a51c5` `quay.io/cilium/operator-generic:stable@sha256:c55a7cbe19fe0b6b28903a085334edb586a3201add9db56d2122c8485f7a51c5` ##### operator `quay.io/cilium/operator:v1.16.4@sha256:c77643984bc17e1a93d83b58fa976d7e72ad1485ce722257594f8596899fdfff` `quay.io/cilium/operator:stable@sha256:c77643984bc17e1a93d83b58fa976d7e72ad1485ce722257594f8596899fdfff` </details> <details> <summary>metallb/metallb (metallb)</summary> ### [`v0.14.9`](https://github.com/metallb/metallb/releases/tag/v0.14.9) [Compare Source](https://github.com/metallb/metallb/compare/v0.14.8...v0.14.9) See the release notes for the details https://metallb.universe.tf/release-notes/#version-0-14-9 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate added 1 commit 2024-11-21 03:03:08 +00:00

chore(deps): update helm release cilium to v1.16.4 46f78d28b1

renovate force-pushed renovate/kubezero-network-kubezero-network-dependencies from 46f78d28b1 to 479365982a

2024-12-18 03:02:36 +00:00

Compare

renovate changed title from ~~chore(deps): update helm release cilium to v1.16.4~~ to chore(deps): update kubezero-network-dependencies

2024-12-18 03:02:39 +00:00

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/kubezero-network-kubezero-network-dependencies:renovate/kubezero-network-kubezero-network-dependencies

git checkout renovate/kubezero-network-kubezero-network-dependencies

Sign in to join this conversation.

No reviewers

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: ZeroDownTime/KubeZero#32

chore(deps): update kubezero-network-dependencies #32

Release Notes

v1.16.5: 1.16.5

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.16.4: 1.16.4

Security Advisories

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v0.14.9

Configuration

Checkout

`v1.16.5`: 1.16.5

`v1.16.4`: 1.16.4

`v0.14.9`