Prepare for release v1.13.7

[michi-covalent]

Summary of Changes

Minor Changes:

• Report the kernel error code in case of packet drops due to failures to create NAT map entries. (Backport PR [v1.13] bpf: nat: report detailed error from map_update_elem() for NAT entries #27652, Upstream PR bpf: nat: report detailed error from map_update_elem() for NAT entries #25883, @julianwiedmann)

Bugfixes:

• bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes (Backport PR [v1.13] bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27998, Upstream PR bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27798, @ti-mo)
• envoy: fix panic writing accesslog without L7 tags (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR envoy: fix panic writing accesslog without L7 tags #27453, @mhofstetter)
• Fix a bug that affected the RevDNAT translation of IPv6 packets with extension headers. (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR bpf: lxc: fix L4 offset in RevNAT path for IPv6 extension headers #27312, @julianwiedmann)
• Fix a bug that could cause an incorrect max. sequence number to be reported by cilium encrypt status when IPsec is enabled. (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR Fix computation of IPsec max. sequence number #27656, @pchaigno)
• Fix a bug where cilium host IP is not read from k8s node annotations (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR Fix a bug where cilium host IP is not read from k8s node annotations #27590, @hemanthmalla)
• Fix bug limiting pod-to-pod network performance under high load when tunneling and IPSec are both enabled. (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR ipsec: discard trace events when monitor aggregation is enabled #27168, @learnitall)
• Fix bug that could cause packet drops of type XfrmOutPolBlock while rotating the IPsec key. (Backport PR Backport v1.13: ipsec: fixes for key rotation #27587, Upstream PR ipsec: fixes for key rotation #27319, @jrfastab)
• Fix connectivity issues caused by missing conntrack entry when service pod connects to itself via clusterIP. (Backport PR [v1.13] bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27998, Upstream PR bpf: lxc: defer CT_INGRESS entry creation for loopback connections #27602, @julianwiedmann)
• gateway-api: Merge externally annotations and labels for kubernetes types (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR gateway-api: Merge externally annotations and labels for kubernetes types #27251, @farodin91)
• ingress: fix panic on ingress rule without HTTPIngressRule (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR ingress: fix panic on ingress rule without HTTPIngressRule #27818, @mhofstetter)
• IPSec fix for race on init resulting in XfrmIn errors and dropped packets (Backport PR v1.13 Backports 2023-09-08 #28022, Upstream PR cilium: Ensure xfrm state is initialized for route IP before publish #28012, @jrfastab)
• k8s: Restrict configuring reserved:init policy via CNP (Backport PR v1.13: k8s: Restrict configuring reserved:init policy via CNP #28039, Upstream PR k8s: Restrict configuring reserved:init policy via CNP #28007, @joestringer)
• Prioritization of which DNS mappings to keep was suboptimal, leading to evictions of mappings related to alive connections, worsening performance of fqdn policies and causing spurious logging. (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR fqdn: fix broken sorting algorithm for DNSZombies #27572, @bimmlerd)
• proxy: Ignore visibility annotation if proxy is disabled (Backport PR v1.13 Backports 2023-08-28 #27741, Upstream PR proxy: Ignore visibility annotation if proxy is disabled #27597, @sayboras)

CI Changes:

• .github/workflows: unify time to wait for images to become available (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR .github/workflows: unify time to wait for images to become available #27706, @tklauser)
• ci-ipsec-upgrade: Bump CLI to v0.15.5 (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR ci-ipsec-upgrade: Bump CLI to v0.15.5 #27230, @brb)
• ci-ipsec-upgrade: Skip upon test/Documentation changes (Backport PR v1.13 Backports 2023-08-28 #27741, Upstream PR ci-ipsec-upgrade: Skip upon test/Documentation changes #27644, @brb)
• ci: fix and standardize checkouts in privileged workflows (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR ci: fix and standardize checkouts in privileged workflows #27193, @nbusseneau)
• ci: increase connectivity test timeout in GHA external workload (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR ci: increase connectivity test timeout in GHA external workload #26975, @mhofstetter)
• ci: remove unavailable K8s 1.22 from GKE config (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR ci: remove unavailable K8s 1.22 from GKE config #27365, @mhofstetter)
• CI: Rename workflow names (Backport PR v1.13 Backports 2023-08-28 #27741, Upstream PR CI: Rename workflow names #27391, @brlbil)
• CI: Update tested k8s version for aks (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR CI: Update tested k8s version for aks #27457, @brlbil)
• gh/actions: Customize cilium-config (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR gh/actions: Customize cilium-config #27416, @brb)
• gh/workflows: Use cilium-config action in ci-ipsec-upgrade (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR gh/workflows: Use cilium-config action in ci-ipsec-upgrade #27359, @brb)
• ginkgo: Remove K8sDatapathCustomCalls (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR ginkgo: Remove K8sDatapathCustomCalls #27911, @brb)

Misc Changes:

• Add WireGuard to the firewall rules documentation (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR Add WireGuard to the firewall rules documentation #27170, @joestringer)
• bpf: egressgw: set trace reason for reply traffic (Backport PR [v1.13] bpf: EgressGW-related tracing improvements #27526, Upstream PR bpf: egressgw: set trace reason for reply traffic #27218, @julianwiedmann)
• bpf: nat: enable CT-driven trace aggregation (Backport PR [v1.13] bpf: EgressGW-related tracing improvements #27526, Upstream PR bpf: nat: enable CT-driven trace aggregation #27178, @julianwiedmann)
• chore(deps): update actions/checkout action to v4 (v1.13) (chore(deps): update actions/checkout action to v4 (v1.13) #27927, @renovate[bot])
• chore(deps): update all github action dependencies (v1.13) (minor) (chore(deps): update all github action dependencies (v1.13) (minor) #27782, @renovate[bot])
• chore(deps): update all lvh-images main (v1.13) (patch) (chore(deps): update all lvh-images main (v1.13) (patch) #27423, @renovate[bot])
• chore(deps): update all lvh-images main (v1.13) (patch) (chore(deps): update all lvh-images main (v1.13) (patch) #27780, @renovate[bot])
• chore(deps): update all lvh-images main (v1.13) (patch) (chore(deps): update all lvh-images main (v1.13) (patch) #27945, @renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v3 (v1.13) (chore(deps): update aws-actions/configure-aws-credentials action to v3 (v1.13) #27783, @renovate[bot])
• chore(deps): update cilium/coccicheck docker tag to v2.4 (v1.13) (chore(deps): update cilium/coccicheck docker tag to v2.4 (v1.13) #27947, @renovate[bot])
• chore(deps): update dependency ubuntu to v22 (v1.13) (chore(deps): update dependency ubuntu to v22 (v1.13) #27784, @renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.17.5 (v1.13) (chore(deps): update docker.io/library/alpine docker tag to v3.17.5 (v1.13) #27781, @renovate[bot])
• chore(deps): update docker.io/library/golang docker tag to v1.20.7 (v1.13) (chore(deps): update docker.io/library/golang docker tag to v1.20.7 (v1.13) #27486, @renovate[bot])
• chore(deps): update docker.io/library/golang docker tag to v1.20.8 (v1.13) (chore(deps): update docker.io/library/golang docker tag to v1.20.8 (v1.13) #27991, @renovate[bot])
• chore(deps): update docker.io/library/golang:1.20.7 docker digest to 741d6f9 (v1.13) (chore(deps): update docker.io/library/golang:1.20.7 docker digest to 741d6f9 (v1.13) #27779, @renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to ec050c3 (v1.13) (chore(deps): update docker.io/library/ubuntu:22.04 docker digest to ec050c3 (v1.13) #27554, @renovate[bot])
• chore(deps): update sigstore/cosign-installer action to v3.1.2 (v1.13) (chore(deps): update sigstore/cosign-installer action to v3.1.2 (v1.13) #27946, @renovate[bot])
• docs: Document DROP_NO_NODE_ID for IPsec (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR docs: Document DROP_NO_NODE_ID for IPsec #27184, @pchaigno)
• docs: Fix config option for spelling filters (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR docs: Fix config option for spelling filters #27537, @qmonnet)
• docs: Fix Documentation Makefile to make Helm reference updates compatible with macOS (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR fix: Helm Docs makefile to be compatible with macOs #27495, @ishuar)
• docs: Harmonise references to Cilium Slack (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR docs: Harmonise references to Cilium Slack #27346, @qmonnet)
• docs: Have Makefile print generated image tags when running with V=0 (Backport PR v1.13 Backports 2023-08-09 #27393, Upstream PR docs: Have Makefile print generated image tags when running with V=0 #27250, @qmonnet)
• docs: Improve wording for labels and services policies (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR docs: Improve wording for labels and services policies #27171, @joestringer)
• docs: update L7 traffic CiliumClusterwideEnvoyConfig example (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR docs: update L7 traffic CiliumClusterwideEnvoyConfig example #27409, @tanjunchen)
• docs: Update the microservices-demo link (Backport PR v1.13 Backports 2023-09-04 #27925, Upstream PR docs: Update the microservices-demo link #27814, @haiyuewa)
• Update Cilium certgen from v0.1.8 to v0.1.9 (Backport PR v1.13 Backports 2023-08-23 #27651, Upstream PR update cilium/certgen from v0.1.8 to v0.1.9 #27511, @rolinh)

Other Changes:

• [1.13] test: add namespace name in pod metadata test ([1.13] test: add namespace name in pod metadata test #28033, @nebril)
• doc: Migrate to .readthedocs.yaml configuration file v2 ([v1.13] doc: Migrate to .readthedocs.yaml v2 configuration and upgrade from Python 3.7 to 3.11 #27570, @doniacld)
• install: Update image digests for v1.13.6 (install: Update image digests for v1.13.6 #27455, @nebril)