Prepare for release v1.9.5

[christarazi]

Summary of Changes

Major Changes:

• Move Azure IPAM out of beta (Backport PR v1.9 backports 2021-02-24 #15104, Upstream PR Move Azure IPAM out of beta #14993, @tgraf)

Minor Changes:

• daemon: do not allow --auto-direct-node-routes when tunneling is enabled (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR daemon: do not allow --auto-direct-node-routes when tunneling is enabled #15196, @jibi)
• datapath: Do not log when kernel config not found (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR datapath: Do not log when kernel config not found #14902, @brb)
• Envoy is updated to release 1.15.3. (Backport PR v1.9 backports 2021-03-08 #15254, Upstream PR Update Envoy to release 1.15.3 #14462, @jrajahalme)
• Envoy is updated to release 1.17.1 (Backport PR Envoy 1.17.1 backport v1.9 #15220, Upstream PR envoy: Update to release 1.17.1 #14754, @jrajahalme)
• helm: Fix and add missing podLabels (Backport PR v1.9 backports 2021-02-24 #15104, Upstream PR helm: Fix and add missing podLabels #14943, @Subreptivus)
• Install Cilium in kube-system on GKE (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR Install Cilium in kube-system on GKE #14899, @pchaigno)
• k8s: update k8s libraries to 1.19.8 (k8s: update k8s libraries to 1.19.8 #15029, @aanm)
• Make Go runtime to return unused memory to OS more often (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR Makefile: build Cilium with madvdontneed=1 #14634, @aanm)
• Make pod-to-pod encryption functional in the IPAM ENI mode. (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR Fix encryption in IPAM ENI mode #14924, @aditighag)
• Revert kernel-check CLI (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR Revert kernel-check CLI #14966, @joestringer)
• Support kube-proxy-replacement when running on Kind (Backport PR v1.9 backports 2021-02-24 #15104, Upstream PR kpr: Make it possible to run bpf_sock on Kind #14951, @brb)

Bugfixes:

• [1.9] doc: Fix masquerade option in AKS/Azure guides ([1.9] doc: Fix masquerade option in AKS/Azure guides #15245, @tgraf)
• Avoid an empty instanceID on EC2 (Backport PR v1.9 backports 2021-02-20 #15047, Upstream PR Avoid an empty instanceID on EC2 #15012, @kkourt)
• bpf: Fix bpf masquerade issue when host connecting to remote pod (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR bpf: Fix bpf masquerade issue when host connecting to remote pod #15206, @borkmann)
• cilium: encryption fix, ipv4-pod-subnets without encryptnode fails (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR cilium: encryption fix, ipv4-pod-subnets without encryptnode fails #14999, @jrfastab)
• cilium: encryption, fixes for ENI & Azure mode with shared podIPs and networkIPs (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR cilium: encryption, fixes for ENI & Azure mode with shared podIPs and networkIPs #15048, @jrfastab)
• Fix a bug that affects connectivity to NodePort service via ExternalIP of the local k8s node. (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR ipcache: Add ExternalIP of the local node to ipcache #14793, @AnishShah)
• Fix bug where PolicyAuditMode could not be changed at runtime if it was enabled at startup (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR config: remove POLICY_AUDIT_MODE from node_config.h #15218, @ArthurChiao)
• Fix connectivity to externalTrafficPolicy=Local services when using the host firewall with kube-proxy (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR Fix reverse DNAT for externalTrafficPolicy=Local service with kube-proxy #14756, @pchaigno)
• Fix ENI compatibility regression between 1.7 <-> 1.8 (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR Fix ENI compatibility regression between 1.7 <-> 1.8 #14991, @tgraf)
• Fix failing bpf-map-sync-cilium_snat_v{4,6}_external controllers when BPF NodePort is disabled (Backport PR v1.9 backports 2021-03-10 #15298, Upstream PR nat: Create SNAT maps only if BPF NodePort is enabled #15175, @pchaigno)
• Fix ICMP Echo ID placement in CT maps (backport v1.9: ICMP CT fixes #15274, @brb)
• Fix ipsec+vxlan bug where egressing packets would bypass masquerading on their way to remote nodes (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR cilium: Send pod->node traffic through tunnel in IPSec+vxlan case #14611, @jrfastab)
• Fix memory leak on stable policy identity churn. (Backport PR v1.9 backports 2021-02-20 #15047, Upstream PR policy: Clear references to old EndpointPolicies #15042, @jrajahalme)
• Fix possible deadlock when querying network interfaces for arping (backport v1.9: Fix possible deadlock when querying netdevs #15227, @brb)
• Fix potential panic on clustermesh environments (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR pkg/kvstore: fix etcd segmentation violation #15107, @aanm)
• Fix remote pod connectivity through VIP in tunneling mode with kube-proxy and per-endpoint routes. Fix IPv6 connectivity to BPF HostPort when kube-proxy is installed (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR bpf: Do not bypass conntrack if running kube-proxy+vxlan+endpoint routes #14675, @pchaigno)
• ipsec: Use 64bits for XFRM output sequence number (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR ipsec: Use 64bits for XFRM output sequence number #15039, @pchaigno)
• iptables: Fix incorrect SNAT bypass with endpoint routes and tunneling (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR iptables: Fix incorrect SNAT bypass with endpoint routes and tunneling #14913, @pchaigno)
• labelsfilter: add reserved labels to default identity label list (Backport PR v1.9 backports 2021-02-11 #14930, Upstream PR labelsfilter: add reserved labels to default identity label list #14114, @ArthurChiao)
• service: Skip upsert of service for disabled IP family (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR service: Skip upsert of service for disabled IP family #15026, @pchaigno)

CI Changes:

• bpf: Enable monitor aggregation in complexity tests (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR bpf: Enable monitor aggregation in complexity tests #14995, @pchaigno)
• checkpatch: update image (skip backports, add a check, suppress one report type) (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR checkpatch: update image (skip backports, add a check, suppress one report type) #15096, @qmonnet)
• ci(smoketest): Pin promtool version in GHA (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR ci(smoketest): Pin promtool version in GHA #14954, @sayboras)
• ci: disable endpointslice in 1.17 cluster (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR ci: disable endpointslice in 1.17 cluster #15058, @nebril)
• ci: use quay.io images in upstream tests (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR ci: use quay.io images in upstream tests #15081, @nebril)
• lbmap: Initialize maps before test suite runs (Backport PR v1.9 backports 2021-02-05 #14870, Upstream PR lbmap: Initialize maps before test suite runs #14842, @christarazi)
• test: Avoid unnecessary restarts of unmanaged pods (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR test: Avoid unnecessary restarts of unmanaged pods #14938, @pchaigno)
• test: Delete all unmanaged pods with a single kubectl delete (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR test: Delete all unmanaged pods with a single kubectl delete #14942, @pchaigno)
• test: K8sVerifier Fix test-verifier's scheduling (Backport PR v1.9 backports 2021-02-05 #14870, Upstream PR test: K8sVerifier Fix test-verifier's scheduling #14803, @pchaigno)
• test: Use Endpoint instead of EndpointSlice in 1.17 (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR test: Use Endpoint instead of EndpointSlice in 1.17 #15010, @nebril)

Misc Changes:

• .github: add stable tag for v1.9 releases (.github: add stable tag for v1.9 releases #15084, @aanm)
• .github: publish into official repo for next release (.github: publish into official repo for next release #15033, @aanm)
• [v1.9] .github: add GitHub actions to build images ([v1.9] .github: add GitHub actions to build images #14936, @aanm)
• Add configurable suffix for operator image repo in helm (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR Add configurable suffix for operator image repo in helm #14952, @nebril)
• add GH action to push hot fix images into -dev repositories (add GH action to push hot fix images into -dev repositories #15062, @aanm)
• Add support for image digests in helm charts (Add support for image digests in helm charts #15186, @aanm)
• Adds a Getting Started Guide for Rancher 2.x using Existing Nodes (Backport PR v1.9 backports 2021-03-10 #15298, Upstream PR Docs: adds a getting started guide for Rancher 2.x #15179, @seanmwinn)
• backporting: Add support for forked cilium repositories (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR backporting: Add support for forked cilium repositories  #15008, @gandro)
• backporting: Update instructions for backporting workflow (Backport PR v1.9 backports 2021-03-02 #15164, Upstream PR backporting: Update instructions for backporting workflow #15118, @aditighag)
• build(deps): bump actions/setup-go from v1 to v2.1.3 (build(deps): bump actions/setup-go from v1 to v2.1.3 #15235, @dependabot[bot])
• build(deps): bump KyleMayes/install-llvm-action from v1 to v1.1.1 (build(deps): bump KyleMayes/install-llvm-action from v1 to v1.1.1 #15211, @dependabot[bot])
• contrib/k8s: use provided image when installing external workload (Backport PR v1.9 backports 2021-02-20 #15047, Upstream PR contrib/k8s: use provided image when installing external workload #15020, @tklauser)
• docs: Add FQDN limitation to IPVLAN docs (Backport PR v1.9 backports 2021-02-11 #14930, Upstream PR docs: Add FQDN limitation to IPVLAN docs #14893, @joestringer)
• docs: Add L7 not working warning to AWS CNI Chaining page (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR docs: Add L7 not working warning to AWS CNI Chaining page #15163, @stimmerman)
• docs: Added instruction to also delete kube-proxy configmap (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR docs: Added instruction to also delete kube-proxy configmap #14847, @yoshz)
• docs: Clarify external workload docs (Backport PR v1.9 backports 2021-03-08 #15254, Upstream PR docs: Clarify external workload docs #15253, @jrajahalme)
• docs: Clarify titles for allow-all-endpoints examples (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR docs: Clarify titles for allow-all-endpoints examples #15145, @pchaigno)
• docs: Document hostport requirements in eni (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR docs: Document hostport requirements in eni #14920, @joestringer)
• docs: Fix max. number of tail calls (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR docs: Fix max. number of tail calls #15162, @pchaigno)
• envoy: Do not use deprecated fields (Backport PR v1.9 backports 2021-03-08 #15254, Upstream PR envoy: Do not use deprecated fields #15232, @jrajahalme)
• envoy: Silently discard expected warnings if flowdebug is not enabled (Backport PR v1.9 backports 2021-03-10 #15288, Upstream PR envoy: Silently discard expected warnings if flowdebug is not enabled #15284, @jrajahalme)
• Fix BPF map handling on upgrade when disabling the preallocation of BPF maps (Backport PR v1.9 backports for bpf map handling 2021-02-24 #15099, Upstream PR Fix BPF map handling on upgrade when disabling the preallocation of BPF maps #14853, @christarazi)
• images: Set GOPS_CONFIG_DIR in scratch images (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR images: Set GOPS_CONFIG_DIR in scratch images #14886, @gandro)
• Improve release scripts (Backport PR v1.9 backports 2021-03-09 #15259, Upstream PR Improve release scripts #15121, @joestringer)
• iptables: Skip CILIUM_TRANSIENT_FORWARD for IPv6 (Backport PR v1.9 backports 2021-02-17 #15006, Upstream PR iptables: Skip CILIUM_TRANSIENT_FORWARD for IPv6 #14994, @pchaigno)
• labelsfilter: Update documentation and add unit tests (Backport PR v1.9 backports 2021-02-12 #14961, Upstream PR labelsfilter: Update documentation and add unit tests #14338, @pchaigno)
• Minor backporting script tweaks (Backport PR [v1.9] backporting: Stop scripts from running on non-Linux #15053, Upstream PR Minor backporting script tweaks #14027, @twpayne)
• tools/licensegen: consider COPYING files (Backport PR v1.9 backports 2021-03-08 #15243, Upstream PR tools/licensegen: consider COPYING files #15239, @tklauser)
• v1.9: Update Go to 1.15.8 (v1.9: Update Go to 1.15.8 #14984, @tklauser)

Other Changes:

• test: Fix docker compose in precheck (test: Fix docker compose in precheck #15171, @nebril)

[joestringer]

The #15298 backport introduced some mixups, I forgot that the release script pulls from the PR description. Basically it caused the PRs that were skipped to be included in this list and the PRs that were backported to be omitted.

Could you add in #15175 and #15179?