Prepare for release v1.12.15

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

.github/maintainers-little-helper.yaml

@@ -1,4 +1,4 @@
-project: "https://github.com/cilium/cilium/projects/251"
+project: "https://github.com/cilium/cilium/projects/253"
 column: "In progress"
 auto-label:
   - "kind/backports"

AUTHORS

@@ -62,6 +62,7 @@ Austin Cawley-Edwards                   austin.cawley@gmail.com
 Ayush Dwivedi                           ayush.dwivedi@accuknox.com
 Barun Acharya                           barun1024@gmail.com
 Beatriz Martínez                        beatriz@isovalent.com
+Benjamin Leggett                        benjamin.leggett@solo.io
 Benjamin Pineau                         benjamin.pineau@datadoghq.com
 Bill Mulligan                           billmulligan516@gmail.com
 Bingshen Wang                           bingshen.wbs@alibaba-inc.com
@@ -71,6 +72,7 @@ Bob Bouteillier                         bob.bouteillier@datadoghq.com
 Bokang Li                               libokang.dev@gmail.com
 Bolun Zhao                              blzhao@google.com
 Boran Car                               boran.car@gmail.com
+Boris Petrovic                          carnerito.b@gmail.com
 Brad Whitfield                          bradswhitfield@gmail.com
 Brian Topping                           brian@coglative.com
 brnck                                   a.berneckas@gmail.com
@@ -108,6 +110,7 @@ Cynthia Thomas                          cynthia@covalent.io
 Cyril Corbon                            corboncyril@gmail.com
 Dale Ragan                              dale.ragan@sap.com
 Dalton Hubble                           dghubble@gmail.com
+Daneyon Hansen                          daneyon.hansen@solo.io
 Đặng Minh Dũng                          dungdm93@live.com
 Daniel Borkmann                         daniel@iogearbox.net
 Daniel Dao                              dqminh89@gmail.com
@@ -187,7 +190,7 @@ Gilberto Bertin                         jibi@cilium.io
 Glib Smaga                              code@gsmaga.com
 Gobinath Krishnamoorthy                 gobinathk@google.com
 Gowtham Sundara                         gowtham.sundara@rapyuta-robotics.com
-gray                                    gray.liang@isovalent.com
+Gray Liang                              gray.liang@isovalent.com
 Guilherme Oki                           guilherme.oki@wildlifestudios.com
 Guilherme Souza                         101073+guilhermef@users.noreply.github.com
 Gunju Kim                               gjkim042@gmail.com

CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## v1.12.15
+
+Summary of Changes
+------------------
+
+**Minor Changes:**
+* bump grpc dependency to 1.56.3 to fix security vulnerability https://github.com/advisories/GHSA-qppj-fm5r-hxr3 (#28529, @aanm)
+* vendor, azure: Bump Azure SDK to Aug 2021 (Backport PR #28317, Upstream PR #28311, @christarazi)
+
+**Bugfixes:**
+* Add drop notifications for various error paths in the datapath. (Backport PR #28437, Upstream PR #25183, @julianwiedmann)
+* Add drop notifications from various error paths in the BPF datapath. (Backport PR #28444, Upstream PR #26956, @julianwiedmann)
+* bpf: fix error handling for invoke_tailcall_if() (Backport PR #28414, Upstream PR #26118, @julianwiedmann)
+* bpf: lxc: fix one missing drop notification in CT lookup tail calls (Backport PR #28351, Upstream PR #26115, @julianwiedmann)
+* envoy: Sync supported resources to fix not found issue (Backport PR #28351, Upstream PR #28272, @sayboras)
+* Fix a bug that causes pod-to-pod traffic between nodes to be dropped when IPsec is enabled and kube-proxy installed rules in both iptables-nft and iptables-legacy. (Backport PR #28444, Upstream PR #28258, @pchaigno)
+* Fix missing drop notifications on conntrack lookup failures when IPv4 and IPv6 are both enabled or socket-level load balancing is disabled. (Backport PR #28295, Upstream PR #25426, @bleggett)
+* Fix the trace notification for hairpinned reply traffic, to indicate the correct security identity for the client. (Backport PR #28295, Upstream PR #28133, @julianwiedmann)
+* Fixes a bug causing panic when counting IPsec keys number via "cilium encrypt status". (Backport PR #28295, Upstream PR #27996, @jschwinger233)
+* pkg/node: Updates GetIPv6AllocCIDRs() to Properly Return Secondary CIDRs (Backport PR #28104, Upstream PR #27855, @danehans)
+
+**CI Changes:**
+* [v1.12] ci: Add a call to the update label backport action (#27879, @pippolo84)
+* [v1.14] GHA: Add clustermesh upgrade and downgrade tests (Backport PR #28564, Upstream PR #28355, @giorio94)
+* CI: Add conn-disrupt-test action for reuse (Backport PR #28152, Upstream PR #27567, @jschwinger233)
+* CI: Add conn-disrupt-test action for reuse (Backport PR #28295, Upstream PR #27567, @jschwinger233)
+* CI: Add IPsec key rotation test (Backport PR #28152, Upstream PR #27203, @jschwinger233)
+* CI: Move IPsec CI jobs into separate pipelines (Backport PR #28152, Upstream PR #26730, @jschwinger233)
+* ci: Run BPF lints on workflow definition changes (Backport PR #28295, Upstream PR #28122, @qmonnet)
+* ci: update k8s versions support for v1.12 (#28246, @nbusseneau)
+* Do not hardcode the AWS VPC CNI plugin version in the conformance-aws-cni GHA workflow (Backport PR #28444, Upstream PR #28392, @giorio94)
+* Refactor CiliumExecContext() Retry Logic (Backport PR #28295, Upstream PR #28131, @carnerito)
+* Update image registry to quay.io (Backport PR #28295, Upstream PR #23093, @oxxenix)
+* v1.12: manual backport of #27193 (#28227, @nbusseneau)
+* workflows/ipsec: Add missing `--flush-ct` for key rotation (Backport PR #28152, Upstream PR #27883, @pchaigno)
+
+**Misc Changes:**
+* chore(deps): update all github action dependencies (v1.12) (patch) (#28114, @renovate[bot])
+* chore(deps): update all github action dependencies to v3 (v1.12) (major) (#28116, @renovate[bot])
+* chore(deps): update all lvh-images main (v1.12) (patch) (#27948, @renovate[bot])
+* chore(deps): update all lvh-images main (v1.12) (patch) (#28215, @renovate[bot])
+* chore(deps): update aws-actions/configure-aws-credentials action to v4 (v1.12) (#28117, @renovate[bot])
+* chore(deps): update dependency cilium/hubble to v0.12.1 (v1.12) (#28526, @renovate[bot])
+* chore(deps): update dependency cilium/hubble to v0.12.2 (v1.12) (#28568, @renovate[bot])
+* chore(deps): update docker.io/library/golang docker tag to v1.20.10 (v1.12) (#28517, @renovate[bot])
+* chore(deps): update docker.io/library/golang:1.20.8 docker digest to 700d726 (v1.12) (#28113, @renovate[bot])
+* chore(deps): update docker.io/library/ubuntu:20.04 docker digest to 0b5642e (v1.12) (#28582, @renovate[bot])
+* chore(deps): update docker/build-push-action action to v4.2.1 (v1.12) (#28115, @renovate[bot])
+* chore(deps): update docker/build-push-action action to v5 (v1.12) (#28118, @renovate[bot])
+* chore(deps): update myrotvorets/set-commit-status-action action to v2 (v1.12) (#28119, @renovate[bot])
+* chore(deps): update quay.io/cilium/hubble docker tag to v0.12.1 (v1.12) (#28544, @renovate[bot])
+* chore(deps): update quay.io/cilium/hubble docker tag to v0.12.2 (v1.12) (#28573, @renovate[bot])
+* ci: fix AWS EKS K8s versions comment (Backport PR #28295, Upstream PR #28249, @nbusseneau)
+* docs: Add more details for the Cluster Mesh key rotation (Backport PR #28295, Upstream PR #28145, @margamanterola)
+* docs: egressgw: document incompatibility with Clustermesh (Backport PR #28104, Upstream PR #27918, @julianwiedmann)
+* docs: Makefile, check-build.sh clean-ups and perf improvements (Backport PR #28295, Upstream PR #28161, @qmonnet)
+* docs: Mention `RouteTableInterfacesOffset` in system requirements (Backport PR #28444, Upstream PR #28358, @gandro)
+* docs: Update Sphinx and its dependencies, Cilium theme (Backport PR #28295, Upstream PR #28172, @qmonnet)
+* Fix potential nil pointer dereference in SelectorManager implementation (Backport PR #28104, Upstream PR #27805, @learnitall)
+* fix(deps): update module golang.org/x/net to v0.17.0 [security] (#28552, @aanm)
+* install/kubernetes: add the `cilium/values.yaml` target to `.PHONY` (Backport PR #28295, Upstream PR #28225, @nbusseneau)
+* ipsec: Atomically upgrade XFRM states with new output-mark (Backport PR #28564, Upstream PR #28485, @pchaigno)
+* Update docs theme (Backport PR #28444, Upstream PR #28403, @raphink)
+* Update Hubble UI from v0.11.0 to v0.12.1 (#28536, @rolinh)
+
+**Other Changes:**
+* Backport v1.12: FQDN fixes (#28138, @joamaki)
+* cocci: backport fix about incorrect warnings and resolve warning related to a const qualifier (#28287, @giorio94)
+* envoy: Bump envoy version to v1.24.11 (#28501, @sayboras)
+* install: Update image digests for v1.12.14 (#28130, @michi-covalent)
+
 ## v1.12.14
 
 Summary of Changes

Documentation/concepts/kubernetes/compatibility-table.rst

@@ -140,6 +140,8 @@
 +-----------------+----------------+
 | v1.12.13        | 1.25.7         |
 +-----------------+----------------+
+| v1.12.14        | 1.25.7         |
++-----------------+----------------+
 | v1.12           | 1.25.7         |
 +-----------------+----------------+
 | latest / master | 1.26.9         |

VERSION

@@ -1 +1 @@
-1.12.14
+1.12.15

install/kubernetes/Makefile.digests

@@ -2,12 +2,12 @@
 # Copyright 2023 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-export CILIUM_DIGEST := "sha256:a54b28a5c15e14f3491c772ca7cfa86266a2b1efb85326bc1ab6c95b91aeaa77"
-export CLUSTERMESH_APISERVER_DIGEST := "sha256:b293c1220cd94f031c561d957f12d9aabb84f59c11dd6ce74d58c1f2fc317f71"
-export DOCKER_PLUGIN_DIGEST := "sha256:95525aa15dc4be5e9a2511c8cbeef7084616ede94586f1e20c00917cb8f3804c"
-export HUBBLE_RELAY_DIGEST := "sha256:78e6f43fff4a7755eaa525cb781b72a7c5cda74a8b1c0c2f560d16eccc2f0d83"
-export OPERATOR_ALIBABACLOUD_DIGEST := "sha256:55a3f9ddf6158d56d8db9e989c6d1e59ac45ef307dfa7c3294be118633d53982"
-export OPERATOR_AWS_DIGEST := "sha256:43ce051c5fe218b0c75c7f8476e7779a234570c2041c9c4200a81ce1494f5984"
-export OPERATOR_AZURE_DIGEST := "sha256:3bbf0384ec2cc90348c99a25c63d9ae37a1ed7b15bf4e7f9eb865f8f46379f2f"
-export OPERATOR_GENERIC_DIGEST := "sha256:b9ce66384c74f79a2982ef3a4602f649d49e9b8b79b58db5faa344c7451cb7c9"
-export OPERATOR_DIGEST := "sha256:8bd42d4f8bd30d2ab026b58792b836b0d25852de42ba019b39148f5943619f29"
+export CILIUM_DIGEST := ""
+export CLUSTERMESH_APISERVER_DIGEST := ""
+export DOCKER_PLUGIN_DIGEST := ""
+export HUBBLE_RELAY_DIGEST := ""
+export OPERATOR_ALIBABACLOUD_DIGEST := ""
+export OPERATOR_AWS_DIGEST := ""
+export OPERATOR_AZURE_DIGEST := ""
+export OPERATOR_GENERIC_DIGEST := ""
+export OPERATOR_DIGEST := ""

install/kubernetes/cilium/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: cilium
 displayName: Cilium
 home: https://cilium.io/
-version: 1.12.14
-appVersion: 1.12.14
+version: 1.12.15
+appVersion: 1.12.15
 kubeVersion: ">= 1.16.0-0"
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.12/Documentation/images/logo-solo.svg
 description: eBPF-based Networking, Security, and Observability