Prepare for release v1.13.0-rc4

[joestringer]

Prepare for release v1.13.0-rc4

Summary of Changes

Major Changes:

• Add per-node configuration overrides. There is a new Kubernetes resource type, CiliumNodeConfig, which allows for fine-grained configuration of Nodes based on label selectors. (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR Per-node configuration overrides (v2) #22656, @squeed)
• Added capability to announce LoadBalancer services via BGP Control Plane (bgp: Announce LoadBalancer services via BGP Control Plane #22397, @dylandreimerink)
• CiliumNetworkPolicy now supports enforcement of SNI in TLS connections. (Policy: Add TLS SNI support #22398, @jrajahalme)

Minor Changes:

• Add option to configure the resources of the cgroups automount init Container in the Cilium Agent DaemonSet. (Helm: Automount Init Container Resources #22384, @shaardie)
• Added 'envoy.filters.http.jwt_authn' and 'envoy.filters.http.oauth2' to the build to be used in CiliumEnvoyConfig resources. (envoy: Update to add auth extensions #22562, @jrajahalme)
• bpf: nat: fix usage of ipv6_hdrlen() with unhandled Extension headers (bpf: nat: fix usage of ipv6_hdrlen() with unhandled Extension headers #22544, @julianwiedmann)
• Bugtool: add flag to exclude object for endpoints (Bugtool: add flag to exclude object for endpoints #22370, @tbalthazar)
• cilium: Add deprecation warning for service ids (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR cilium: Add deprecation warning for service ids #22700, @joamaki)
• clustermesh: Add an infrastructure to connect time parameter exchange and capability negotiation (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR clustermesh: Add an infrastructure for connect time parameter exchange and capability negotiation #22553, @YutaroHayakawa)
• egressgw: drop support for CiliumEgressNATPolicy (Egress Gateway: Remove deprecated CENP CRD #21874, @julianwiedmann)
• envoy: Support LB capability for existing k8s Service (Backport PR v1.13 backports 2022-12-22 #22835, Upstream PR envoy: Support LB capability for existing k8s Service #21244, @sayboras)
• helm: Support configuring Cilium shared Ingress Service type and nodePorts (helm: Support configuring Cilium shared Ingress Service type and nodePorts #22583, @chancez)
• install/kubernetes: make securityContext SELinux options configurable (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR install/kubernetes: make securityContext SELinux options configurable #22721, @tklauser)
• Load multiple programs for one CollectionSpec loading (Load multiple programs for one CollectionSpec loading #22025, @alexkats)
• Remove deprecated spec.eni.{min-allocate,pre-allocate,max-above-watermark} parameters (Remove deprecated spec.eni.{min-allocate,pre-allocate,max-above-watermark} parameters #21951, @obaranov1)
• Traffic can now we redirected to Envoy listeners via Cilium Network Policy listener option. (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR Add policy listener support #21600, @jrajahalme)

Bugfixes:

• bpf: add drop notification for missed L7 LB tailcall in to-netdev (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR bpf: add drop notification for missed L7 LB tailcall in to-netdev #22679, @julianwiedmann)
• bpf: nodeport: fix drop notification in IPv6 revNAT (bpf: nodeport: fix drop notification in IPv6 revNAT #22543, @julianwiedmann)
• bpf: nodeport: wire up trace aggregation for rev_nodeport_lb6() (Backport PR v1.13 backports 2022-12-22 #22835, Upstream PR bpf: nodeport: wire up trace aggregation for rev_nodeport_lb6() #22794, @julianwiedmann)
• daemon: Do not remove PERM L2 entries in L4LB (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR daemon: Do not remove PERM L2 entries in L4LB #22676, @brb)
• Do not let the bandwidth manager decrease existing sysctl values. (pkg/bandwidth: enlarge sysctl settings only if they are below baseline #22468, @ArthurChiao)
• Fix a data race in dnsproxy which could lead to DNS requests drops. (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR fqdn: dnsproxy: fix data race in dns proxy implementation #22619, @aspsk)
• Fix bug that caused ingress policies to be enforced twice when running with tunneling and endpoint routes. (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR datapath: Don't enforce ingress policies at overlay if endpoint routes are enabled #22333, @pchaigno)
• Fix race condition in DNS proxy when multiple DNS requests for the same name end up with policy drops, even though the traffic is allowed (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR daemon, fqdn: Fix race between parallel DNS requests for the same name #22252, @christarazi)
• Fixes semaphore_rejected_total metric and adds new scope to proxy_upstream_reply_seconds metric. (Adding/fixing DNSProxy metrics #21267, @rahulkjoshi)
• Improve garbage collection for FQDNs particularly with high-churn IP names such as Amazon S3. (fqdn: Fix GC for dead IPs on live names over limit #22510, @joestringer)
• ipam/crd: Fix router initialization fatal when ENI data race happens (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR ipam/crd: Fix agent fatal on router initialization #22477, @jaffcheng)

CI Changes:

• .github/workflows: bump ubuntu version for code-ql (.github/workflows: bump ubuntu version for code-ql #22505, @aanm)
• .github: add debug for codeql (.github: add debug for codeql #22607, @aanm)
• ci: Replace deprecated hubble observe -o json with -o jsonpb (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR ci: Replace deprecated hubble observe -o json with -o jsonpb #22796, @gandro)
• ci: update cilium-cli to v0.12.11 for master, v1.11 and v1.12 workflows (ci: update cilium-cli to v0.12.11 for master, v1.11 and v1.12 workflows #22494, @tklauser)
• contrib/scripts: Add check for use of viper's default instance (contrib/scripts: Add check for use of viper's default instance #22445, @joamaki)
• daemon/cmd: improve stale cilium endpoint error handling. (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR daemon/cmd: improve stale cilium endpoint error handling. #22600, @tommyp1ckles)
• dependabot: monthly update of cloud provider SDK Go modules (dependabot: monthly update of cloud provider SDK Go modules #22489, @tklauser)
• Fix when install k8s-1.25 ,no need cni install (Fix when install k8s-1.25 ,no need cni install #22355, @yanggangtony)
• gh/workflows: Add DP CI for encryption (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR gh/workflows: Add DP CI for encryption #22418, @brb)
• gh/workflows: tune LVH VM params (gh/workflows: tune LVH VM params #22425, @brb)
• gha: Add retry mechanism for conformance ingress (shared) (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR gha: Add retry mechanism for conformance ingress (shared) #22673, @sayboras)
• Revert "dependabot: monthly update of cloud provider SDK Go modules" (Revert "dependabot: monthly update of cloud provider SDK Go modules" #22571, @pippolo84)
• test/helpers: Fix retry condition for CiliumExecContext (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR test/helpers: Fix retry condition for CiliumExecContext #22726, @christarazi)
• test/l4lb, nat64x46: pass k8s api server to the standalone proxy (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR test/l4lb, nat64x46: pass k8s api server to the standalone proxy #22627, @squeed)
• test: Keep trying exec if killed (test: Keep trying exec if killed #22570, @jrajahalme)
• test: service: fix formatting of error msg in doFragmentedRequest() (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR test: service: fix formatting of error msg in doFragmentedRequest() #22772, @julianwiedmann)
• test: Speify test/k8s directory on k8s_install.sh to modify pulling images (Test: Specify test/k8s directory during creating preload vm #22530, @Shunpoco)
• workflow: disable tests pod-to-world and pod-to-cidr (workflow: disable tests pod-to-world and pod-to-cidr #22475, @brlbil)
• workflow: Reenable IPsec tests in EKS for v1.12 (workflow: Reenable IPsec tests in EKS for v1.12 #22618, @pchaigno)
• workflow: Workaround EKS flake (workflow: Workaround EKS flake #22590, @pchaigno)
• workflows: add wait for no operation for cleaning up GKE (workflows: add wait for no operation for cleaning up GKE #22350, @brlbil)
• workflows: Collect a final sysdump on AKS (workflows: Collect a final sysdump on AKS #22537, @pchaigno)
• workflows: Collect sysdumps on failures (workflows: Collect sysdumps on failures #22538, @pchaigno)
• workflows: Reduce verbosity of connectivity tests (workflows: Reduce verbosity of connectivity tests #22605, @pchaigno)
• workflows: Reduce verbosity of connectivity tests on AKS (workflows: Reduce verbosity of connectivity tests on AKS #22536, @pchaigno)

Misc Changes:

• .github/workflows: print author association (.github/workflows: print author association #22606, @aanm)
• .github/workflows: use right event type for auto labeler (.github/workflows: use right event type for auto labeler #22508, @aanm)
• .github: add PR labeler for external contributions (.github: add PR labeler for external contributions #22461, @aanm)
• Add --pprof-debug args to cilium-bugtool (Add --pprof-debug args to cilium-bugtool #22282, @yanggangtony)
• Add per-node configuration overrides. There is a new Kubernetes resource type, CiliumNodeConfig, which allows for fine-grained configuration of Nodes based on label selectors. (per-node configuration overrides #22163, @squeed)
• Add sphinxcontrib-googleanalytics to doc requirements (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR Add sphinxcontrib-googleanalytics to doc requirements #22821, @chalin)
• Add tests for hubble metrics handlers (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR Add tests for hubble metrics handlers #22518, @marqc)
• backporting: leave backport/author PRs alone (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR backporting: leave backport/author PRs alone #22654, @bimmlerd)
• bpf_sockops string constant can use const eSockops replace (bpf_sockops string constant can use const eSockops replace #22490, @tanberBro)
• build(deps): bump actions/cache from 3.0.11 to 3.2.0 (build(deps): bump actions/cache from 3.0.11 to 3.2.0 #22843, @dependabot[bot])
• build(deps): bump actions/setup-go from 3.3.1 to 3.4.0 (build(deps): bump actions/setup-go from 3.3.1 to 3.4.0 #22483, @dependabot[bot])
• build(deps): bump actions/setup-go from 3.4.0 to 3.5.0 (build(deps): bump actions/setup-go from 3.4.0 to 3.5.0 #22718, @dependabot[bot])
• build(deps): bump actions/stale from 5.1.1 to 6.0.1 (build(deps): bump actions/stale from 5.1.1 to 6.0.1 #22499, @dependabot[bot])
• build(deps): bump github.com/go-openapi/runtime from 0.24.2 to 0.25.0 (build(deps): bump github.com/go-openapi/runtime from 0.24.2 to 0.25.0 #22413, @dependabot[bot])
• build(deps): bump github.com/hashicorp/consul/api from 1.17.0 to 1.18.0 (build(deps): bump github.com/hashicorp/consul/api from 1.17.0 to 1.18.0 #22549, @dependabot[bot])
• build(deps): bump github.com/onsi/gomega from 1.23.0 to 1.24.1 (build(deps): bump github.com/onsi/gomega from 1.23.0 to 1.24.1 #22391, @dependabot[bot])
• build(deps): bump github.com/tidwall/gjson from 1.14.3 to 1.14.4 (build(deps): bump github.com/tidwall/gjson from 1.14.3 to 1.14.4 #22395, @dependabot[bot])
• build(deps): bump github/codeql-action from 2.1.32 to 2.1.35 (build(deps): bump github/codeql-action from 2.1.32 to 2.1.35 #22498, @dependabot[bot])
• build(deps): bump github/codeql-action from 2.1.35 to 2.1.36 (build(deps): bump github/codeql-action from 2.1.35 to 2.1.36 #22633, @dependabot[bot])
• build(deps): bump github/codeql-action from 2.1.36 to 2.1.37 (build(deps): bump github/codeql-action from 2.1.36 to 2.1.37 #22736, @dependabot[bot])
• build(deps): bump go.opentelemetry.io/otel from 1.11.1 to 1.11.2 (build(deps): bump go.opentelemetry.io/otel from 1.11.1 to 1.11.2 #22621, @dependabot[bot])
• build(deps): bump golang.org/x/sys from 0.2.0 to 0.3.0 (build(deps): bump golang.org/x/sys from 0.2.0 to 0.3.0 #22548, @dependabot[bot])
• build(deps): bump helm/kind-action from 1.4.0 to 1.5.0 (build(deps): bump helm/kind-action from 1.4.0 to 1.5.0 #22720, @dependabot[bot])
• build(deps): bump KyleMayes/install-llvm-action from 1.6.0 to 1.6.1 (build(deps): bump KyleMayes/install-llvm-action from 1.6.0 to 1.6.1 #22592, @dependabot[bot])
• chore(deps): update base-images (v1.13) (chore(deps): update base-images (v1.13) #22647, @renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.17.0 (master) (chore(deps): update docker.io/library/alpine docker tag to v3.17.0 (master) #22317, @renovate[bot])
• chore(deps): update docker.io/library/golang:1.19.3 docker digest to 10e3c0f (master) (chore(deps): update docker.io/library/golang:1.19.3 docker digest to 10e3c0f (master) #22566, @renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to 27cb6e6 (v1.13) (chore(deps): update docker.io/library/ubuntu:22.04 docker digest to 27cb6e6 (v1.13) #22661, @renovate[bot])
• contrib: exclude non-running pods in k8s-unmanaged script (contrib: exclude non-running pods in k8s-unmanaged script #22515, @felfa01)
• contributing: Document CNCF DCO Guidelines v1.0 (contributing: Document CNCF DCO Guidelines v1.0 #22509, @joestringer)
• daemon: Close the identityAllocator on shutdown (daemon: Close the identityAllocator on shutdown #22411, @joestringer)
• daemon: Do not fail CI runs for already deleted CEP (daemon: Do not fail CI runs for already deleted CEP #22474, @jrajahalme)
• delete redundant type conversion (delete redundant type conversion #22376, @tanberBro)
• Docs: Replace the way to install golangci-lint to NA(OS-specific) (Docs: Replace the way to install golangci-lint to NA(OS-specific) #22532, @Shunpoco)
• docs: restructure bpf guide (docs: restructure bpf guide #21922, @yoyo-go)
• docs: update cmdref with missing flag (docs: update cmdref with missing flag #22525, @aanm)
• document helm conntrackGCInterval crdWaitTimeout identityChangeGracePeriod (helm: document conntrackGCInterval crdWaitTimeout identityChangeGracePeriod #22352, @vincentmli)
• Enable Google Analytics 4 (Backport PR v1.13 backports 2022-12-22 #22835, Upstream PR Enable Google Analytics 4 #22220, @chalin)
• envoy: Skip NPHDS upsert when IP is already included (envoy: Skip NPHDS upsert when IP is already included #22289, @jrajahalme)
• examples: Add Envoy admin listener (examples: Add Envoy admin listener #22386, @jrajahalme)
• Fix long-time failure of "ipcache-inject-labels" controller due to incorrect backoff time for retry (pkg/controller: fix incorrect backoff time for next retry #21886, @ArthurChiao)
• Fix note for 'func numWorkerThreads()' (Fix note for 'func numWorkerThreads()' #22412, @yanggangtony)
• Fix prepare release process (Fix prepare release process #22487, @aanm)
• fix:omit comparison to bool constant (fix:omit comparison to bool constant #22588, @yulng)
• fix:remove ioutil to accomodate newer Go versions (fix:remove ioutil to accomodate newer Go versions #22383, @yulng)
• fuzzing: bump go-fuzz-headers (fuzzing: bump go-fuzz-headers #22501, @AdamKorcz)
• go.mod, vendor: drop client-go from replace directives (go.mod, vendor: drop client-go from replace directives #22547, @tklauser)
• go.mod, vendor: update cloud provider SDK Go modules for December 2022 (go.mod, vendor: update cloud provider SDK Go modules for December 2022 #22469, @tklauser)
• hive: Allow multiple calls to Hive.Shutdown (hive: Allow multiple calls to Hive.Shutdown #22551, @dylandreimerink)
• hubble/metrics: ProcessFlow() is optional for metrics handlers (hubble/metrics: ProcessFlow() is optional for metrics handlers #20367, @chancez)
• Initial datapath support for Cilium mTLS has been added. (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR Datapath support for Cilium mTLS #21822, @jrajahalme)
• Introduce v3 backend maps (Backport PR v1.13 backports 2022-12-21 #22822, Upstream PR Introduce v3 backend maps #21797, @YutaroHayakawa)
• ipcache: Fix IPcache leak of remote-node IP addresses (ipcache: Fix IPcache leak of remote-node IP addresses #21932, @pchaigno)
• Keep command help message capital (Keep command help message capital #22276, @yanggangtony)
• modify the deprecated label beta.kubernetes.io/instance-type (modify the deprecated label beta.kubernetes.io/instance-type #21941, @my-git9)
• operator: Remove use of global vars in cilium node synchronizer (operator: Remove use of global vars in cilium node synchronizer #22491, @joamaki)
• operator: Wait for informers to shut down when stopping (Backport PR v1.13 backports 2022-12-22 #22835, Upstream PR operator: Wait for informers to shut down when stopping #22761, @joamaki)
• pkg: Follow Go convention on capitalization (pkg: Follow Go convention on capitalization #22534, @yulng)
• Prepare for release v1.13.0-rc3 (Prepare for release v1.13.0-rc3 #22481, @aanm)
• Prepare v1.13 stable branch (Prepare v1.13 stable branch #22612, @joestringer)
• Remove unnecessary imports of pkg/policy (Remove unnecessary imports of pkg/policy #21996, @jrajahalme)
• Revert "Mount host /boot into cilium-agent container" (Revert "Mount host /boot into cilium-agent container" #22326, @ti-mo)
• Revert "per-node configuration overrides" pull request (Revert "per-node configuration overrides" pull request #22630, @pchaigno)
• support reset backoff period (backoff: support reset backoff period #21937, @wu0407)
• test/control-plane: Add nil check for agentHandle.Close receiver (test/control-plane: Add nil check for agentHandle.Close receiver #22399, @dylandreimerink)
• Update Cilium install guide about EKS aws-node DaemonSet potential connectivity problem on uninstall (Update Cilium install guide about EKS aws-node DaemonSet potential connectivity problem on uninstall #22620, @NikAleksandrov)
• Update Go to 1.19.4 (Update Go to 1.19.4 #22589, @tklauser)
• update gops and ginkgo mod version for match the current go.mod (update gops and ginkgo mod version for match the current go.mod #22427, @yanggangtony)
• Update Layer 7 Protocol Visibility Document. (Backport PR v1.13 backports 2022-12-22 #22835, Upstream PR Update Layer 7 Protocol Visibility Document. #22807, @obaranov1)
• util: fix wrong comment of GetNumPossibleCPUs (util: fix wrong comment of GetNumPossibleCPUs #22540, @117503445)

Other Changes:

• build(deps): bump certifi from 2022.6.15 to 2022.12.7 in /Documentation (build(deps): bump certifi from 2022.6.15 to 2022.12.7 in /Documentation #22609, @dependabot[bot])