Prepare for release v1.11.16

[michi-covalent]

Summary of Changes

Minor Changes:

• envoy: Bump envoy version to v1.23.7 (envoy: Bump envoy version to v1.23.7 #24748, @sayboras)

Bugfixes:

• Add missing xfrm-no-track rules for IPv6 IPSec. This fixes a connectivity issue for IPv6 IPSec with externalTrafficPolicy=local. (Backport PR v1.11 backports 2023-03-28 #24604, Upstream PR pkg: add missing xfrm-no-track rules from ipv6 #24557, @jschwinger233)
• Fix for disabled cloud provider rate limiting (Backport PR v1.11 Backports 2023-03-20 #24458, Upstream PR Fix for disabled cloud provider rate limiting #24413, @hemanthmalla)
• Fix missing delete events on informer re-lists to ensure all delete events are correctly emitted and using the latest known object state, so that all event handlers and stores always reflect the actual apiserver state as best as possible (update k8s dependencies to 1.23.17 #24872, @aanm)
• Fixed bug where L7 rules would be incorrectly merged between rules for the same (remote) endpoint. This bug could have caused L7 rules to be bypassed via a wildcard header rule being improperly appended to the set of HTTP rules when both a policy with HTTP header rules applying to multiple endpoints and an allow-all rule for only one of those endpoints are specified. (Backport PR v1.11 backports 2023-04-13 #24852, Upstream PR policy: Do not share same policy for multiple cached selectors #24788, @jrajahalme)
• Handle leaked service backends that may lead to filling up of lb4_backends map and thereby connectivity issues. (Backport PR v1.11 backports 2023-04-12 #24823, Upstream PR pkg/service: Handle leaked backends #24681, @aditighag)
• ipsec: Clean up stale XFRM policies and states (Backport PR v1.11 backports 2023-04-12 #24823, Upstream PR ipsec: Clean up stale XFRM policies and states #24773, @pchaigno)

CI Changes:

• Fix race conditions when deleting CNP / CCNP in e2e tests (Backport PR v1.11 Backports 2023-04-03 #24710, Upstream PR Fix race condition of deleting ccnp in e2e test #24484, @jschwinger233)
• renovate: Fix Hubble release digest regex (Backport PR v1.11 backports 2023-03-28 #24604, Upstream PR renovate: Fix Hubble release digest regex #24477, @gandro)
• tests: add exceptions for lease errors due to etcd (Backport PR v1.11 backports 2023-04-12 #24823, Upstream PR tests: add exceptions for lease errors due to etcd #24723, @jibi)

Misc Changes:

• checker: Fix incorrect checker for ExportedEqual() (Backport PR v1.11 Backports 2023-03-20 #24458, Upstream PR checker: Fix incorrect checker for ExportedEqual() #24373, @christarazi)
• chore(deps): update dependency cilium/hubble to v0.11.3 (v1.11) (chore(deps): update dependency cilium/hubble to v0.11.3 (v1.11) #24820, @renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.16.5 (v1.11) (chore(deps): update docker.io/library/alpine docker tag to v3.16.5 (v1.11) #24644, @renovate[bot])
• chore(deps): update docker.io/library/alpine:3.16.4 docker digest to 2cf17aa (v1.11) (chore(deps): update docker.io/library/alpine:3.16.4 docker digest to 2cf17aa (v1.11) #24493, @renovate[bot])
• chore(deps): update docker.io/library/ubuntu:20.04 docker digest to 24a0df4 (v1.11) (chore(deps): update docker.io/library/ubuntu:20.04 docker digest to 24a0df4 (v1.11) #24498, @renovate[bot])
• chore(deps): update quay.io/cilium/hubble docker tag to v0.11.3 (v1.11) (chore(deps): update quay.io/cilium/hubble docker tag to v0.11.3 (v1.11) #24499, @renovate[bot])
• docs: add note that there are two Cilium CLIs (Backport PR v1.11 backports 2023-03-28 #24604, Upstream PR docs: add note that there are two Cilium CLIs #24435, @lizrice)
• docs: fix typo in operations/troubleshooting.rst (Backport PR v1.11 backports 2023-03-28 #24604, Upstream PR docs: fix typo in operations/troubleshooting.rst #24460, @NikAleksandrov)
• docs: Fix upgradeCompatibility references (Backport PR v1.11 backports 2023-04-12 #24823, Upstream PR docs: Fix upgradeCompatibility references #24711, @joestringer)
• docs: Update Cluster Mesh requirements to mention node InternalIP explicitly (Backport PR v1.11 Backports 2023-03-20 #24458, Upstream PR Update clustermesh requirements to mention node InternalIP explicitly #24164, @jspaleta)
• docs: Update the documentation for the --conntrack-gc-interval flag (Backport PR v1.11 Backports 2023-03-20 #24458, Upstream PR docs: Update the documentation for the --conntrack-gc-interval flag #24400, @pchaigno)
• Fix duplicated logs for test-output.log (Backport PR v1.11 Backports 2023-03-20 #24458, Upstream PR Fix duplicated logs for test-output.log #24171, @romanspb80)
• hubble-ui: allow ingress from non root / urls (Backport PR v1.11 backports 2023-03-28 #24604, Upstream PR hubble-ui: allow ingress from non root / urls #23631, @geakstr)
• loader: Don't compile .asm files by default (Backport PR v1.11 backports 2023-04-12 #24823, Upstream PR loader: Don't compile .asm files by default #24769, @pchaigno)
• pkg/bandwidth: add error for bandwidth manager not being enabled (Backport PR v1.11 backports 2023-04-12 #24823, Upstream PR pkg/bandwidth: add error for bandwidth manager not being enabled #24715, @aanm)

Other Changes:

• Add IPSec remark for upgrade to v1.11.15 (Add IPSec remark for upgrade to v1.11.15 #24632, @darox)
• Add note about known regression in ConfigMap values prioritized over flags in Cilium agent (docs: add upgrade notes for 1.11 regressions #24743, @aanm)
• In service recovery, don't skip if one of the service recovery fails (v1.11 backport: In service recovery, don't skip if one of the service recovery fails #23922, @jaredledvina)
• install: Update image digests for v1.11.15 (install: Update image digests for v1.11.15 #24425, @nebril)
• v1.11: docs: Document IPsec upgrade issue on v1.11.15 (v1.11: docs: Document IPsec upgrade issue on v1.11.15 #24704, @pchaigno)

[gentoo-root]

/test-backport-1.11

Job 'Cilium-PR-K8s-1.18-kernel-4.9' failed:

Click to show.

Test Name

K8sPolicyTest Basic Test checks all kind of Kubernetes policies

Failure Output

FAIL: Found 2 k8s-app=cilium logs matching list of errors that must be investigated:

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.18-kernel-4.9/2655/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.18-kernel-4.9 so I can create one.

Job 'Cilium-PR-K8s-1.17-kernel-4.9' failed:

Click to show.

Test Name

K8sDatapathConfig MonitorAggregation Checks that monitor aggregation restricts notifications

Failure Output

FAIL: Found 2 k8s-app=cilium logs matching list of errors that must be investigated:

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.17-kernel-4.9/1303/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.17-kernel-4.9 so I can create one.

Job 'Cilium-PR-K8s-1.20-kernel-4.9' failed:

Click to show.

Test Name

K8sKafkaPolicyTest Kafka Policy Tests KafkaPolicies

Failure Output

FAIL: Found 2 k8s-app=cilium logs matching list of errors that must be investigated:

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.20-kernel-4.9/1808/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.20-kernel-4.9 so I can create one.