Merge branch 'main' into hostnames-listeners

cilium · Feb 17, 2024 · fef4274 · fef4274
2 parents e860a4b + 48bd2ac
commit fef4274
Show file tree

Hide file tree

Showing 279 changed files with 5,199 additions and 2,963 deletions.
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yaml b/.github/ISSUE_TEMPLATE/bug_report.yaml
@@ -73,6 +73,13 @@ body:
         Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
     validations:
       required: false
+  - type: checkboxes
+    id: users
+    attributes:
+      label: Cilium Users Document
+      options:
+        - label: Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md)
+          required: false
   - type: checkboxes
     id: terms
     attributes:

diff --git a/.github/actions/aws/k8s-versions.yaml b/.github/actions/aws/k8s-versions.yaml
@@ -1,16 +1,16 @@
 # List of k8s version for EKS tests
 ---
 include:
-  - version: "1.23"
-    region: ca-west-1
   - version: "1.24"
-    region: us-west-2
+    region: ca-west-1
   - version: "1.25"
-    region: us-west-1
+    region: us-west-2
   - version: "1.26"
-    region: us-east-2
+    region: us-west-1
   - version: "1.27"
-    region: ca-central-1
+    region: us-east-2
+    default: true
   - version: "1.28"
+    region: ca-central-1
+  - version: "1.29"
     region: us-east-1
-    default: true
diff --git a/.github/actions/azure/k8s-versions.yaml b/.github/actions/azure/k8s-versions.yaml
@@ -4,13 +4,14 @@ include:
   - version: "1.25"
     location: westus3
     index: 1
+    disabled: true
   - version: "1.26"
     location: westus2
     index: 2
   - version: "1.27"
     location: eastus2
     index: 3
+    default: true
   - version: "1.28"
     location: eastus
     index: 4
-    default: true
diff --git a/.github/actions/ginkgo/main-k8s-versions.yaml b/.github/actions/ginkgo/main-k8s-versions.yaml
@@ -4,27 +4,27 @@ include:
   - k8s-version: "1.29"
     ip-family: "dual"
     # renovate: datasource=docker
-    kube-image: "quay.io/cilium/kindest-node:v1.29.0-rc.1@sha256:6631d58da3569930cf21697c2113feb9c76bc044c1c13d98808a3695dd91d8b0"
+    kube-image: "kindest/node:v1.29.1@sha256:a0cc28af37cf39b019e2b448c54d1a3f789de32536cb5a5db61a49623e527144"
     # renovate: datasource=docker depName=quay.io/lvh-images/kind
-    kernel: "bpf-next-20240204.012837@sha256:5ea765f57df9ef4c8f67662617290c5574f0774f43025f57284ae1cc3b6f140e"
+    kernel: "bpf-next-20240215.093821@sha256:2fe708fb2ad623daa7a699a302c6e75e6847050909dd87017204f08a7401d4a0"
 
   - k8s-version: "1.28"
     ip-family: "dual"
     # renovate: datasource=docker
     kube-image: "kindest/node:v1.28.6@sha256:b7e1cf6b2b729f604133c667a6be8aab6f4dde5bb042c1891ae248d9154f665b"
     # renovate: datasource=docker depName=quay.io/lvh-images/kind
-    kernel: "4.19-20240201.165956@sha256:980c3aae3921a1d504171eca0634bdff6ca4263cc6cc50e545ca2bad2926613e"
+    kernel: "4.19-20240215.093821@sha256:b5c40794f24509c786868b84cb17b7aeed78b9e2a171ca7774d06506576c6039"
 
   - k8s-version: "1.27"
     ip-family: "dual"
     # renovate: datasource=docker
     kube-image: "kindest/node:v1.27.10@sha256:3700c811144e24a6c6181065265f69b9bf0b437c45741017182d7c82b908918f"
     # renovate: datasource=docker depName=quay.io/lvh-images/kind
-    kernel: "4.19-20240201.165956@sha256:980c3aae3921a1d504171eca0634bdff6ca4263cc6cc50e545ca2bad2926613e"
+    kernel: "4.19-20240215.093821@sha256:b5c40794f24509c786868b84cb17b7aeed78b9e2a171ca7774d06506576c6039"
 
   - k8s-version: "1.26"
     ip-family: "dual"
     # renovate: datasource=docker
     kube-image: "kindest/node:v1.26.13@sha256:15ae92d507b7d4aec6e8920d358fc63d3b980493db191d7327541fbaaed1f789"
     # renovate: datasource=docker depName=quay.io/lvh-images/kind
-    kernel: "5.4-20240201.165956@sha256:d2a2c1565d255ce1b5bdec06a4cc2ba86c633c6a5c95602f5fc668ce5610040b"
+    kernel: "5.4-20240215.093821@sha256:390095f72237b1ffc7d40179357391aa4baaab3eca6e123d97a5a1838766eb45"
diff --git a/.github/actions/gke/k8s-versions.yaml b/.github/actions/gke/k8s-versions.yaml
@@ -1,19 +1,19 @@
 # List of k8s version for GKE tests
 ---
 k8s:
-  - version: "1.24"
+  - version: "1.25"
     zone: us-west1-b
     vmIndex: 1
-  - version: "1.25"
+  - version: "1.26"
     zone: us-west2-c
     vmIndex: 2
-  - version: "1.26"
+  - version: "1.27"
     zone: us-west3-a
     vmIndex: 3
-  - version: "1.27"
+    default: true
+  - version: "1.28"
     zone: us-east4-b
     vmIndex: 4
-  - version: "1.28"
+  - version: "1.29"
     zone: us-east1-c
     vmIndex: 5
-    default: true
diff --git a/.github/actions/kvstore/action.yaml b/.github/actions/kvstore/action.yaml
@@ -7,7 +7,7 @@ inputs:
     default: "1"
   etcd-image:
     description: "etcd docker image"
-    default: gcr.io/etcd-development/etcd:v3.5.11@sha256:8eff25cf636711fb48426005b55fc9f4d6ffa4f38f483fa87c8cc82976347bbb
+    default: gcr.io/etcd-development/etcd:v3.5.12@sha256:cebe24b890641de3e7ff8a640c4597bdda321090c29f4dedcedaa8cadbbe08e1
   name:
     description: "Base name of the etcd containers (to which the index is appended)"
     default: kvstore

diff --git a/.github/actions/lvh-kind/action.yaml b/.github/actions/lvh-kind/action.yaml
@@ -37,7 +37,7 @@ runs:
         cmd: |
           cd /host
           if [ "${{ inputs.kind-image-vsn }}" != "" ]; then
-            export IMAGE=quay.io/cilium/kindest-node:${{ inputs.kind-image-vsn }}
+            export IMAGE=kindest/node:${{ inputs.kind-image-vsn }}
           fi
           ./contrib/scripts/kind.sh ${{ inputs.kind-params }} 0.0.0.0 6443
 

diff --git a/.github/actions/set-env-variables/action.yml b/.github/actions/set-env-variables/action.yml
@@ -12,7 +12,7 @@ runs:
         echo "EGRESS_GATEWAY_HELM_VALUES=--helm-set=egressGateway.enabled=true" >> $GITHUB_ENV
         echo "CILIUM_CLI_RELEASE_REPO=cilium/cilium-cli" >> $GITHUB_ENV
         # renovate: datasource=github-releases depName=cilium/cilium-cli
-        CILIUM_CLI_VERSION="v0.15.21"
+        CILIUM_CLI_VERSION="v0.15.22"
         echo "CILIUM_CLI_VERSION=$CILIUM_CLI_VERSION" >> $GITHUB_ENV
         echo "PUSH_TO_DOCKER_HUB=true" >> $GITHUB_ENV
         echo "GCP_PERF_RESULTS_BUCKET=gs://cilium-scale-results" >> $GITHUB_ENV
diff --git a/.github/kind-config-ipv6.yaml b/.github/kind-config-ipv6.yaml
@@ -2,7 +2,7 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
   - role: control-plane
-    image: quay.io/cilium/kindest-node:v1.29.0-rc.1
+    image: kindest/node:v1.29.1@sha256:a0cc28af37cf39b019e2b448c54d1a3f789de32536cb5a5db61a49623e527144
     kubeadmConfigPatches:
       # To make sure that there is no taint for master node.
       # Otherwise additional worker node might be required for conformance testing.
@@ -12,7 +12,7 @@ nodes:
         nodeRegistration:
           taints: []
   - role: worker
-    image: quay.io/cilium/kindest-node:v1.29.0-rc.1
+    image: kindest/node:v1.29.1@sha256:a0cc28af37cf39b019e2b448c54d1a3f789de32536cb5a5db61a49623e527144
 networking:
   ipFamily: ipv6
   disableDefaultCNI: true

diff --git a/.github/kind-config.yaml b/.github/kind-config.yaml
@@ -2,7 +2,7 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
   - role: control-plane
-    image: quay.io/cilium/kindest-node:v1.29.0-rc.1
+    image: kindest/node:v1.29.1@sha256:a0cc28af37cf39b019e2b448c54d1a3f789de32536cb5a5db61a49623e527144
     kubeadmConfigPatches:
       # To make sure that there is no taint for master node.
       # Otherwise additional worker node might be required for conformance testing.
@@ -12,7 +12,7 @@ nodes:
         nodeRegistration:
           taints: []
   - role: worker
-    image: quay.io/cilium/kindest-node:v1.29.0-rc.1
+    image: kindest/node:v1.29.1@sha256:a0cc28af37cf39b019e2b448c54d1a3f789de32536cb5a5db61a49623e527144
 networking:
   disableDefaultCNI: true
   podSubnet: "10.244.0.0/16"

diff --git a/.github/kind-config.yaml.tmpl b/.github/kind-config.yaml.tmpl
@@ -2,7 +2,7 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
   - role: control-plane
-    image: quay.io/cilium/kindest-node:${K8S_VERSION}
+    image: kindest/node:${K8S_VERSION}
     kubeadmConfigPatches:
       # To make sure that there is no taint for master node.
       # Otherwise additional worker node might be required for conformance testing.
@@ -12,9 +12,9 @@ nodes:
         nodeRegistration:
           taints: []
   - role: worker
-    image: quay.io/cilium/kindest-node:${K8S_VERSION}
+    image: kindest/node:${K8S_VERSION}
   - role: worker
-    image: quay.io/cilium/kindest-node:${K8S_VERSION}
+    image: kindest/node:${K8S_VERSION}
 networking:
   disableDefaultCNI: true
   ipFamily: ${IPFAMILY}

diff --git a/.github/maintainers-little-helper.yaml b/.github/maintainers-little-helper.yaml
@@ -1,33 +1,33 @@
 move-to-projects-for-labels-xored:
   v1.15:
     needs-backport/1.15:
-      project: "https://github.com/cilium/cilium/projects/266"
+      project: "https://github.com/cilium/cilium/projects/270"
       column: "Needs backport from main"
     backport-pending/1.15:
-      project: "https://github.com/cilium/cilium/projects/266"
+      project: "https://github.com/cilium/cilium/projects/270"
       column: "Backport pending to v1.15"
     backport-done/1.15:
-      project: "https://github.com/cilium/cilium/projects/266"
+      project: "https://github.com/cilium/cilium/projects/270"
       column: "Backport done to v1.15"
   v1.14:
     needs-backport/1.14:
-      project: "https://github.com/cilium/cilium/projects/265"
+      project: "https://github.com/cilium/cilium/projects/268"
       column: "Needs backport from main"
     backport-pending/1.14:
-      project: "https://github.com/cilium/cilium/projects/265"
+      project: "https://github.com/cilium/cilium/projects/268"
       column: "Backport pending to v1.14"
     backport-done/1.14:
-      project: "https://github.com/cilium/cilium/projects/265"
+      project: "https://github.com/cilium/cilium/projects/268"
       column: "Backport done to v1.14"
   v1.13:
     needs-backport/1.13:
-      project: "https://github.com/cilium/cilium/projects/264"
+      project: "https://github.com/cilium/cilium/projects/269"
       column: "Needs backport from main"
     backport-pending/1.13:
-      project: "https://github.com/cilium/cilium/projects/264"
+      project: "https://github.com/cilium/cilium/projects/269"
       column: "Backport pending to v1.13"
     backport-done/1.13:
-      project: "https://github.com/cilium/cilium/projects/264"
+      project: "https://github.com/cilium/cilium/projects/269"
       column: "Backport done to v1.13"
   v1.12:
     needs-backport/1.12:

diff --git a/.github/renovate.json5 b/.github/renovate.json5
@@ -499,7 +499,8 @@
     {
       "fileMatch": [
         "images/cilium/download-hubble\\.sh",
-        "images/runtime/build-gops.sh"
+        "images/runtime/build-gops.sh",
+        "images/hubble-relay/download-grpc-health-probe.sh"
       ],
       // These regexes manage version and digest strings in shell scripts,
       // similar to the examples shown here:

diff --git a/.github/workflows/build-images-base.yaml b/.github/workflows/build-images-base.yaml
@@ -45,7 +45,7 @@ jobs:
         uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
+        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
 
       # Warning: since this is a privileged workflow, subsequent workflow job
       # steps must take care not to execute untrusted code.
@@ -145,7 +145,7 @@ jobs:
 
       - name: Upload artifact digests runtime
         if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: image-digest cilium-runtime
           path: image-digest
@@ -232,7 +232,7 @@ jobs:
 
       - name: Upload artifact digests builder
         if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: image-digest cilium-builder
           path: image-digest
@@ -287,7 +287,7 @@ jobs:
           mkdir -p image-digest/
 
       - name: Download digests of all images built
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+        uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
         with:
           path: image-digest/
 

diff --git a/.github/workflows/build-images-beta.yaml b/.github/workflows/build-images-beta.yaml
@@ -108,7 +108,7 @@ jobs:
             OPERATOR_VARIANT=${{ matrix.name }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
+        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
 
       - name: Sign Container Image
         run: |
@@ -154,7 +154,7 @@ jobs:
 
       # Upload artifact digests
       - name: Upload artifact digests
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: image-digest ${{ matrix.name }}
           path: image-digest
@@ -171,7 +171,7 @@ jobs:
           mkdir -p image-digest/
 
       - name: Download digests of all images built
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+        uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
         with:
           path: image-digest/
 

diff --git a/.github/workflows/build-images-ci.yaml b/.github/workflows/build-images-ci.yaml
@@ -136,7 +136,7 @@ jobs:
           target: import-cache
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
+        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
 
       - name: Install Bom
         shell: bash
@@ -399,7 +399,7 @@ jobs:
 
       # Upload artifact digests
       - name: Upload artifact digests
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: image-digest ${{ matrix.name }}
           path: image-digest
@@ -443,7 +443,7 @@ jobs:
           mkdir -p image-digest/
 
       - name: Download digests of all images built
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+        uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
         with:
           path: image-digest/
 

diff --git a/.github/workflows/build-images-docs-builder.yaml b/.github/workflows/build-images-docs-builder.yaml
@@ -167,7 +167,7 @@ jobs:
           echo "" >> image-digest/docs-builder.txt
 
       - name: Upload artifact digests
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: image-digest docs-builder
           path: image-digest

diff --git a/.github/workflows/build-images-hotfixes.yaml b/.github/workflows/build-images-hotfixes.yaml
@@ -103,7 +103,7 @@ jobs:
             OPERATOR_VARIANT=${{ matrix.name }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
+        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
 
       - name: Sign Container Image
         run: |
@@ -157,7 +157,7 @@ jobs:
 
       # Upload artifact digests
       - name: Upload artifact digests
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: image-digest ${{ matrix.name }}
           path: image-digest
@@ -174,7 +174,7 @@ jobs:
           mkdir -p image-digest/
 
       - name: Download digests of all images built
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+        uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
         with:
           path: image-digest/