Prepare for release v1.14.9

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

.github/maintainers-little-helper.yaml

@@ -1,4 +1,4 @@
-project: "https://github.com/cilium/cilium/projects/276"
+project: "https://github.com/cilium/cilium/projects/279"
 column: "In progress"
 auto-label:
   - "kind/backports"

AUTHORS

@@ -508,7 +508,7 @@ Priya Sharma                            Priya.Sharma6693@gmail.com
 Qasim Sarfraz                           qasim.sarfraz@esailors.de
 Qifeng Guo                              qifeng.guo@daocloud.io
 Qingchuan Hao                           qinhao@microsoft.com
-Quentin Monnet                          quentin@isovalent.com
+Quentin Monnet                          qmo@qmon.net
 Raam                                    ram29@bskyb.com
 Rachid Zarouali                         rachid.zarouali@sevensphere.io
 Raghu Gyambavantha                      raghug@bld-ml-loan4.olympus.f5net.com

CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## v1.14.9
+
+Summary of Changes
+------------------
+
+**Minor Changes:**
+* bgpv1: BGP Control Plane metrics (Backport PR #31569, Upstream PR #31469, @YutaroHayakawa)
+* cni: use default logger with timestamps. (Backport PR #31335, Upstream PR #31014, @tommyp1ckles)
+* Introduce `cilium-dbg encrypt flush --stale` flag to remove XFRM states and policies with stale node IDs. (Backport PR #31335, Upstream PR #31159, @pchaigno)
+
+**Bugfixes:**
+* [v1.14 - Author backport] envoy: enable k8s secret watch even if only CEC is enabled (#31452, @mhofstetter)
+* Fix a bug where pod label updates are not reflected in endpoint labels in presence of filtered labels. (Backport PR #31474, Upstream PR #31395, @tklauser)
+* gateway-api: Retrieve LB service from same namespace (Backport PR #31495, Upstream PR #31271, @sayboras)
+* Handle InvalidParameterValue as well for PD fallback (Backport PR #31495, Upstream PR #31016, @hemanthmalla)
+* helm: Update pod affinity for cilium-envoy (Backport PR #31495, Upstream PR #31150, @sayboras)
+* Hubble: fix traffic direction and is reply when IPSec is enabled (Backport PR #31569, Upstream PR #31211, @kaworu)
+* k8s/utils: correctly filter out labels in StripPodSpecialLabels (Backport PR #31474, Upstream PR #31421, @tklauser)
+
+**CI Changes:**
+* [v1.14] test: Remove duplicate Cilium deployments in some datapath config tests (#31521, @qmonnet)
+* AKS: avoid overlapping pod and service CIDRs (Backport PR #31569, Upstream PR #31504, @bimmlerd)
+* Centralize configuration of kind version/image in GitHub Action workflows (Backport PR #31192, Upstream PR #30916, @giorio94)
+* Checkout the target branch, instead of the default one, on pull_request based GHA test workflows (Backport PR #31192, Upstream PR #31198, @giorio94)
+* ci: Bump lvh-kind ssh-startup-wait-retries (Backport PR #31495, Upstream PR #31387, @YutaroHayakawa)
+* ci: fix checking `github.event.pull_request.head.sha` (Backport PR #31495, Upstream PR #26775, @mhofstetter)
+* controlplane: fix mechanism for ensuring watchers (Backport PR #31542, Upstream PR #31030, @bimmlerd)
+* gha: checkout target branch in multi pool workflow (#31545, @giorio94)
+* gha: disable fail-fast on integration tests (Backport PR #31495, Upstream PR #31420, @giorio94)
+* gha: drop unused check_url environment variable (Backport PR #31192, Upstream PR #30928, @giorio94)
+* introduce ARM github workflows (Backport PR #31335, Upstream PR #31196, @aanm)
+* ipam: deepcopy interface resource correctly. (Backport PR #31495, Upstream PR #26998, @tommyp1ckles)
+* k8s_install.sh: specify the CNI version (Backport PR #31335, Upstream PR #31182, @aanm)
+* loader: fix issue where errors cancelled compile cause error logs. (Backport PR #31335, Upstream PR #30988, @tommyp1ckles)
+* Reduce flakiness of controlplane tests (Backport PR #31542, Upstream PR #30906, @bimmlerd)
+* slices: don't modify missed input slice in test (Backport PR #31495, Upstream PR #31119, @bimmlerd)
+
+**Misc Changes:**
+* Add monitor aggregation for all events related to packets ingressing to the network-facing device. (Backport PR #31335, Upstream PR #31015, @learnitall)
+* Address race condition in TestGetIdentity (Backport PR #31542, Upstream PR #30885, @bimmlerd)
+* bgpv1: Adjust ConnectionRetryTimeSeconds to 1 in component tests (Backport PR #31335, Upstream PR #31218, @YutaroHayakawa)
+* chore(deps): update all github action dependencies (v1.14) (#31483, @renovate[bot])
+* chore(deps): update all github action dependencies (v1.14) (#31583, @renovate[bot])
+* chore(deps): update dependency cilium/cilium-cli to v0.16.3 (v1.14) (#31465, @renovate[bot])
+* chore(deps): update docker.io/library/golang:1.21.8 docker digest to 8560736 (v1.14) (#31481, @renovate[bot])
+* chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to 55c6361 (v1.14) (#31482, @renovate[bot])
+* cilium-dbg: listing load-balancing configurations displays L7LB proxy port (Backport PR #31569, Upstream PR #31503, @mhofstetter)
+* doc: Clarified GwAPI KPR prerequisites (Backport PR #31495, Upstream PR #31366, @PhilipSchmid)
+* docs: Warn on key rotations during upgrades (Backport PR #31495, Upstream PR #31437, @pchaigno)
+* Downgrade L2 Neighbor Discovery failure log to Debug (Backport PR #31335, Upstream PR #31179, @YutaroHayakawa)
+* ingress: Update docs with network policy example (Backport PR #31335, Upstream PR #31060, @sayboras)
+
+**Other Changes:**
+* bgpv1: Disable PodCIDR Reconciler for unsupported IPAM modes (#31353, @YutaroHayakawa)
+* install: Update image digests for v1.14.8 (#31404, @thorn3r)
+* v1.14: IPsec Fixes (#31611, @pchaigno)
+
 ## v1.14.8
 
 Summary of Changes

Documentation/network/kubernetes/compatibility-table.rst

@@ -90,7 +90,9 @@
 +--------------------+----------------+
 | v1.13.12           | 1.26.7         |
 +--------------------+----------------+
-| v1.13              | 1.26.7         |
+| v1.13.13           | 1.26.7         |
++--------------------+----------------+
+| v1.13              | 1.26.8         |
 +--------------------+----------------+
 | v1.14.0-pre.2      | 1.26.8         |
 +--------------------+----------------+
@@ -128,7 +130,9 @@
 +--------------------+----------------+
 | v1.14.7            | 1.27.0         |
 +--------------------+----------------+
-| v1.14              | 1.27.0         |
+| v1.14.8            | 1.27.0         |
++--------------------+----------------+
+| v1.14              | 1.27.1         |
 +--------------------+----------------+
-| latest / main      | 1.29.3         |
+| latest / main      | 1.29.4         |
 +--------------------+----------------+

VERSION

@@ -1 +1 @@
-1.14.8
+1.14.9

install/kubernetes/Makefile.digests

@@ -2,13 +2,13 @@
 # Copyright 2024 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-export CILIUM_DIGEST := "sha256:7fca3ba4b04af066e8b086b5c1a52e30f52db01ffc642e7db0a439514aed3ada"
-export CLUSTERMESH_APISERVER_DIGEST := "sha256:9af7cc0ed5ed9b98db347afcfc119399cae6df0744aff9193ebebe309c39ee8e"
-export DOCKER_PLUGIN_DIGEST := "sha256:87377cfea3277f0f9c1dd3e945c26f3457877bc14391c609c1f11d2b55545c59"
-export HUBBLE_RELAY_DIGEST := "sha256:e15ae63bf844f447cc976919541a9a8c218989360bbf2cf6b9f5ebbd8ae5045d"
-export KVSTOREMESH_DIGEST := "sha256:f865d9fbe31a175bc61d6bd1ef8a840f577add90042b3bf07c3d2b9775157249"
-export OPERATOR_ALIBABACLOUD_DIGEST := "sha256:59e5104392a65052d3fffc6789625474d4a86a70457554ab7252badd09a4f5e6"
-export OPERATOR_AWS_DIGEST := "sha256:42ba7ccc5e0707bf7ee109da5582ed47afa827b2d2e17efd441148bdaa3b21ba"
-export OPERATOR_AZURE_DIGEST := "sha256:e825da52bcdde15b56708090aad982d3b0db928aa09a2db339d200c6de0f66de"
-export OPERATOR_GENERIC_DIGEST := "sha256:56d373c12483c09964a00a29246595917603a077a298aa90a98e4de32c86b7dc"
-export OPERATOR_DIGEST := "sha256:441cff37da49d698124bece5cad59471d126313859aaba5f640643e7d6586a2c"
+export CILIUM_DIGEST := ""
+export CLUSTERMESH_APISERVER_DIGEST := ""
+export DOCKER_PLUGIN_DIGEST := ""
+export HUBBLE_RELAY_DIGEST := ""
+export KVSTOREMESH_DIGEST := ""
+export OPERATOR_ALIBABACLOUD_DIGEST := ""
+export OPERATOR_AWS_DIGEST := ""
+export OPERATOR_AZURE_DIGEST := ""
+export OPERATOR_GENERIC_DIGEST := ""
+export OPERATOR_DIGEST := ""

install/kubernetes/cilium/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: cilium
 displayName: Cilium
 home: https://cilium.io/
-version: 1.14.8
-appVersion: 1.14.8
+version: 1.14.9
+appVersion: 1.14.9
 kubeVersion: ">= 1.16.0-0"
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.14/Documentation/images/logo-solo.svg
 description: eBPF-based Networking, Security, and Observability