v1.13 Backports 2024-04-30

.github/workflows/conformance-aks.yaml

@@ -189,12 +189,6 @@ jobs:
         with:
           creds: ${{ secrets.AZURE_PR_SP_CREDS }}
 
-      - name: Install aks-preview CLI extension
-        run: |
-            az extension add --name aks-preview
-            az extension update --name aks-preview
-            az version
-
       - name: Create AKS cluster
         run: |
           # Create group

.github/workflows/documentation.yaml

@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
+          fetch-depth: 0
       - name: Check code changes
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: docs-tree
@@ -58,7 +59,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Build HTML
-        uses: docker://quay.io/cilium/docs-builder:6f53f8ad89e205c78afcce5e106061a4e45484de@sha256:db358ec7730851a641cc8ee99fde367072e2bd0b13d35b5856eee6b2d0eaa7d5
+        uses: docker://quay.io/cilium/docs-builder:5de04f050b0326696e7fac5a2bcaa488bc8ed149@sha256:ac9e4f3a9caf7f182d8ae24a613dbb7071dab5ea34b6f3d5320654d5dea28155
         with:
           entrypoint: ./Documentation/check-build.sh
           args: html

.github/workflows/lint-bpf-checks.yaml

@@ -29,6 +29,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
+          fetch-depth: 0
       - name: Check code changes
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: changes

.github/workflows/tests-smoke-ipv6.yaml

@@ -34,6 +34,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
+          fetch-depth: 0
       - name: Check code changes
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: tested-tree

.github/workflows/tests-smoke.yaml

@@ -34,6 +34,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
+          fetch-depth: 0
       - name: Check code changes
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: tested-tree

Documentation/observability/metrics.rst

@@ -84,7 +84,7 @@ option is set in the ``scrape_configs`` section:
           regex: true
         - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
           action: replace
-          regex: (.+):(?:\d+);(\d+)
+          regex: ([^:]+)(?::\d+)?;(\d+)
           replacement: ${1}:${2}
           target_label: __address__
 

Documentation/requirements.txt

@@ -42,8 +42,8 @@ mistune==2.0.5
 packaging==23.1
 pathspec==0.11.2
 picobox==3.0.0
-pydantic==2.3.0
-pydantic_core==2.6.3
+pydantic==2.7.1
+pydantic_core==2.18.2
 pyenchant==3.2.2
 Pygments==2.16.1
 PyYAML==6.0.1

examples/kubernetes/addons/prometheus/files/prometheus/prometheus.yaml

@@ -27,7 +27,7 @@ scrape_configs:
       - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
         action: replace
         target_label: __address__
-        regex: (.+)(?::\d+);(\d+)
+        regex: ([^:]+)(?::\d+)?;(\d+)
         replacement: $1:$2
       - action: labelmap
         regex: __meta_kubernetes_service_label_(.+)
@@ -52,7 +52,7 @@ scrape_configs:
         regex: (.+)
       - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
         action: replace
-        regex: (.+):(?:\d+);(\d+)
+        regex: ([^:]+)(?::\d+)?;(\d+)
         replacement: ${1}:${2}
         target_label: __address__
       - action: labelmap

go.mod

@@ -20,7 +20,7 @@ require (
 	github.com/cilium/coverbee v0.2.2
 	github.com/cilium/customvet v0.0.0-20201209211516-9852765c1ac4
 	github.com/cilium/deepequal-gen v0.0.0-20200406125435-ad6a9003139e
-	github.com/cilium/dns v1.1.51-0.20240411200813-4e6b438d9e05
+	github.com/cilium/dns v1.1.51-0.20240416134107-d47d0dd702a1
 	github.com/cilium/ebpf v0.9.4-0.20221102092914-a9cf21df64c2
 	github.com/cilium/ipam v0.0.0-20220824141044-46ef3d556735
 	github.com/cilium/kafka v0.0.0-20180809090225-01ce283b732b

install/kubernetes/Makefile.values

@@ -34,8 +34,8 @@ export CILIUM_ETCD_OPERATOR_REPO:=quay.io/cilium/cilium-etcd-operator
 export CILIUM_ETCD_OPERATOR_VERSION:=v2.0.7@sha256:04b8327f7f992693c2cb483b999041ed8f92efc8e14f2a5f3ab95574a65ea2dc
 export CILIUM_NODEINIT_REPO:=quay.io/cilium/startup-script
 # renovate: datasource=docker depName=quay.io/cilium/startup-script
-export CILIUM_NODEINIT_VERSION:=62093c5c233ea914bfa26a10ba41f8780d9b737f
-export CILIUM_NODEINIT_DIGEST:=sha256:e1d442546e868db1a3289166c14011e0dbd32115b338b963e56f830972bc22a2
+export CILIUM_NODEINIT_VERSION:=19fb149fb3d5c7a37d3edfaf10a2be3ab7386661
+export CILIUM_NODEINIT_DIGEST:=sha256:820155cb3b7f00c8d61c1cffa68c44440906cb046bdbad8ff544f5deb1103456
 export CILIUM_OPERATOR_BASE_REPO:=quay.io/cilium/operator
 
 export ETCD_REPO:=quay.io/coreos/etcd

install/kubernetes/cilium/README.md

@@ -460,7 +460,7 @@ contributors across the globe, there is almost always someone available to help.
 | nodeinit.extraEnv | list | `[]` | Additional nodeinit environment variables. |
 | nodeinit.extraVolumeMounts | list | `[]` | Additional nodeinit volumeMounts. |
 | nodeinit.extraVolumes | list | `[]` | Additional nodeinit volumes. |
-| nodeinit.image | object | `{"digest":"sha256:e1d442546e868db1a3289166c14011e0dbd32115b338b963e56f830972bc22a2","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"62093c5c233ea914bfa26a10ba41f8780d9b737f","useDigest":true}` | node-init image. |
+| nodeinit.image | object | `{"digest":"sha256:820155cb3b7f00c8d61c1cffa68c44440906cb046bdbad8ff544f5deb1103456","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"19fb149fb3d5c7a37d3edfaf10a2be3ab7386661","useDigest":true}` | node-init image. |
 | nodeinit.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for nodeinit pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | nodeinit.podAnnotations | object | `{}` | Annotations to be added to node-init pods. |
 | nodeinit.podLabels | object | `{}` | Labels to be added to node-init pods. |

install/kubernetes/cilium/templates/cilium-agent/daemonset.yaml

@@ -423,6 +423,9 @@ spec:
         {{- if (not (kindIs "invalid" .Values.daemon.blockedConfigOverrides)) }}
         - "--deny-config-keys={{.Values.daemon.blockedConfigOverrides}}"
         {{- end }}
+        {{- if .Values.kubeConfigPath }}
+        - "--k8s-kubeconfig-path={{ .Values.kubeConfigPath }}"
+        {{- end }}
         env:
         - name: K8S_NODE_NAME
           valueFrom:
@@ -445,6 +448,11 @@ spec:
         volumeMounts:
         - name: tmp
           mountPath: /tmp
+        {{- if .Values.kubeConfigPath }}
+        - name: kube-config
+          mountPath: {{ .Values.kubeConfigPath }}
+          readOnly: true
+        {{- end }}
         {{- with .Values.extraVolumeMounts }}
         {{- toYaml . | nindent 8 }}
         {{- end }}

install/kubernetes/cilium/values.yaml

@@ -2081,8 +2081,8 @@ nodeinit:
   image:
     override: ~
     repository: "quay.io/cilium/startup-script"
-    tag: "62093c5c233ea914bfa26a10ba41f8780d9b737f"
-    digest: "sha256:e1d442546e868db1a3289166c14011e0dbd32115b338b963e56f830972bc22a2"
+    tag: "19fb149fb3d5c7a37d3edfaf10a2be3ab7386661"
+    digest: "sha256:820155cb3b7f00c8d61c1cffa68c44440906cb046bdbad8ff544f5deb1103456"
     useDigest: true
     pullPolicy: "IfNotPresent"
 

pkg/endpoint/events.go

@@ -4,6 +4,8 @@
 package endpoint
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"strconv"
 
@@ -44,7 +46,9 @@ func (ev *EndpointRegenerationEvent) Handle(res chan interface{}) {
 	// being deleted at the same time. More info PR-1777.
 	doneFunc, err := e.owner.QueueEndpointBuild(regenContext.parentContext, uint64(e.ID))
 	if err != nil {
-		e.getLogger().WithError(err).Warning("unable to queue endpoint build")
+		if !errors.Is(err, context.Canceled) {
+			e.getLogger().WithError(err).Warning("unable to queue endpoint build")
+		}
 	} else if doneFunc != nil {
 		e.getLogger().Debug("Dequeued endpoint from build queue")
 

pkg/fqdn/dnsproxy/proxy.go

@@ -997,7 +997,7 @@ func (p *DNSProxy) ServeDNS(w dns.ResponseWriter, request *dns.Msg) {
 
 	ipv4 := targetServerIP.To4() != nil
 	dialer := net.Dialer{
-		Timeout: 2 * time.Second,
+		Timeout: ProxyForwardTimeout,
 		Control: func(network, address string, c syscall.RawConn) error {
 			var soerr error
 			if err := c.Control(func(su uintptr) {

pkg/ipam/crd_eni.go

@@ -136,19 +136,19 @@ func waitForNetlinkDevices(configByMac configMap) (linkByMac linkMap, err error)
 	for try := 0; try < waitForNetlinkDevicesMaxTries; try++ {
 		links, err := netlink.LinkList()
 		if err != nil {
-			return nil, fmt.Errorf("failed to obtain eni link list: %w", err)
-		}
-
-		linkByMac = linkMap{}
-		for _, link := range links {
-			mac := link.Attrs().HardwareAddr.String()
-			if _, ok := configByMac[mac]; ok {
-				linkByMac[mac] = link
+			log.WithError(err).Error("failed to obtain eni link list")
+		} else {
+			linkByMac = linkMap{}
+			for _, link := range links {
+				mac := link.Attrs().HardwareAddr.String()
+				if _, ok := configByMac[mac]; ok {
+					linkByMac[mac] = link
+				}
 			}
-		}
 
-		if len(linkByMac) == len(configByMac) {
-			return linkByMac, nil
+			if len(linkByMac) == len(configByMac) {
+				return linkByMac, nil
+			}
 		}
 
 		sleep := backoff.CalculateDuration(

vendor/modules.txt

@@ -181,7 +181,7 @@ github.com/cilium/customvet/analysis/timeafter
 ## explicit; go 1.14
 github.com/cilium/deepequal-gen
 github.com/cilium/deepequal-gen/generators
-# github.com/cilium/dns v1.1.51-0.20240411200813-4e6b438d9e05
+# github.com/cilium/dns v1.1.51-0.20240416134107-d47d0dd702a1
 ## explicit; go 1.18
 github.com/cilium/dns
 # github.com/cilium/ebpf v0.9.4-0.20221102092914-a9cf21df64c2