1.11.15

We are pleased to release Cilium v1.11.15. This release contains several bugfixes, including (but not limited to) fixing a bootstrapping issue, and fixing enable-stale-cilium-endpoint-cleanup flag. We also made several improvements around helm charts.

It also addresses for following security issues:

• GHSA-8fg8-jh2h-f2hc
• GHSA-4hc4-pgfx-3mrx

Note: When updating to this release, make sure that you are using new helm chart version.

Summary of Changes

Minor Changes:

• envoy: Bump envoy to 1.23.4 (Backport PR #23958, Upstream PR #23800, @sayboras)
• helm: Add pod and container security context (Backport PR #24089, Upstream PR #23443, @sayboras)
• helm: Add SA automount configuration (Backport PR #24089, Upstream PR #23441, @sayboras)

Bugfixes:

• Add the option to preserve CNI configuration file on agent shutdown. This can help prevent issues where pods can no longer be deleted. This may cause some transient error messages to be displayed if a pod is scheduled while Cilium is being upgraded. (Backport PR #24198, Upstream PR #24009, @squeed)
• agent: fix incorrect deletion of veth host interfaces on bootstrap (Backport PR #23958, Upstream PR #23787, @giorio94)
• clustermesh: fix services cache bloat due to incorrect deletion (Backport PR #24089, Upstream PR #23947, @giorio94)
• envoy: Avoid empty typeURL for all resources (Backport PR #23862, Upstream PR #23763, @sayboras)
• Fix connectivity issue upon agent restart in case of ipv6 + direct routing + KPR replacement (Backport PR #23958, Upstream PR #23857, @giorio94)
• Fix enable-stale-cilium-endpoint-cleanup flag not actually disabling the cleanup init set when set to false. This provides a workaround for an existing panic that can occur when running using etcd kvstore. (Backport PR #24308, Upstream PR #23874, @sjdot)
• Fix leaking service backend entries when services with terminating backends were deleted. (#23858, @aditighag)
• ipam/crd: Fix panic due to concurrent map read and map write (Backport PR #23958, Upstream PR #23713, @gandro)
• node: require ipv4 address when wireguard is enabled (Backport PR #24040, Upstream PR #23552, @giorio94)

Misc Changes:

• Add leader requirement to watch from Etcd. (Backport PR #24089, Upstream PR #23590, @marseel)
• bpf: Fix usage of tunnel map structs (Backport PR #24089, Upstream PR #23469, @pchaigno)
• bugtool: Add ingress/egress tc filter dump (Backport PR #24198, Upstream PR #24057, @joestringer)
• chore(deps): update all github action dependencies (v1.11) (minor) (#24004, @renovate[bot])
• chore(deps): update all github action dependencies (v1.11) (patch) (#23995, @renovate[bot])
• chore(deps): update dependency cilium/hubble to v0.11.2 (v1.11) (#23924, @renovate[bot])
• chore(deps): update docker.io/library/ubuntu:20.04 docker digest to 9fa30fc (v1.11) (#24141, @renovate[bot])
• chore(deps): update quay.io/cilium/hubble docker tag to v0.11.2 (v1.11) (#23949, @renovate[bot])
• docs: Document CONFIG_PERF_EVENTS requirement (Backport PR #24198, Upstream PR #24055, @joestringer)
• docs: Fix the dead link to Mellanox performance tuning guide (Backport PR #24089, Upstream PR #24012, @gentoo-root)
• docs: replace usage of api.twitter.com (Backport PR #23958, Upstream PR #23669, @kaworu)
• fix(deps): update module golang.org/x/net to v0.7.0 [security] (master) (Backport PR #23958, Upstream PR #23904, @renovate[bot])
• Fixed link to broken anchor in RKE doc (Backport PR #23958, Upstream PR #23706, @raphink)
• IPsec: Remove IP_POOLS logic (Backport PR #24089, Upstream PR #24030, @pchaigno)
• Node ID restoration (Backport PR #23686, Upstream PR #23578, @pchaigno)
• Remove / in RKE doc link as it causes redirect bug (Backport PR #23958, Upstream PR #23728, @raphink)
• workflow: fixes LLVM, Clang cache and install path (Backport PR #23958, Upstream PR #23740, @brlbil)

Other Changes:

• docs: Enable Google Analytics for v1.11 documentation (#24066, @qmonnet)
• images: update cilium-{runtime,builder} for 1.11 (#24302, @nebril)
• install: Update image digests for v1.11.14 (#23737, @joestringer)
• Revert "Pick up etcd v3.4.23" (#23789, @michi-covalent)
• v1.11 - Backport initContainer change (#24329, @ferozsalam)
• v1.11 Backports 2023-03-14 (#24368, @nebril)
• v1.11 Backports 2023-03-15 (#24385, @nebril)

Docker Manifests

cilium

docker.io/cilium/cilium:v1.11.15@sha256:434ea1ff40b8db76c2be6cabfa1bbd2b887eaabe42e757651ea14757468e3bf4
quay.io/cilium/cilium:v1.11.15@sha256:434ea1ff40b8db76c2be6cabfa1bbd2b887eaabe42e757651ea14757468e3bf4

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.11.15@sha256:66071d67f0249909c81cc3f94ad1dd2ae51e1451c400183a9337c04b9c1e076f
quay.io/cilium/clustermesh-apiserver:v1.11.15@sha256:66071d67f0249909c81cc3f94ad1dd2ae51e1451c400183a9337c04b9c1e076f

docker-plugin

docker.io/cilium/docker-plugin:v1.11.15@sha256:e2d10187f4e31a00fd751b6e5ac56bd3698ab6bd3c404cff06b7b2740d4327df
quay.io/cilium/docker-plugin:v1.11.15@sha256:e2d10187f4e31a00fd751b6e5ac56bd3698ab6bd3c404cff06b7b2740d4327df

hubble-relay

docker.io/cilium/hubble-relay:v1.11.15@sha256:352a65dde7c324ace5d6442f626f82c19550dd581e17f8f7e7aba30325c96d9e
quay.io/cilium/hubble-relay:v1.11.15@sha256:352a65dde7c324ace5d6442f626f82c19550dd581e17f8f7e7aba30325c96d9e

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.11.15@sha256:712972b46f592bd80a8e4c66e9b5cdcc73705740bf2cea84a6df131107a01699
quay.io/cilium/operator-alibabacloud:v1.11.15@sha256:712972b46f592bd80a8e4c66e9b5cdcc73705740bf2cea84a6df131107a01699

operator-aws

docker.io/cilium/operator-aws:v1.11.15@sha256:3aa776003eee064a6896b6ad712f55293d4e045defbe14d3768d224ce254d5c3
quay.io/cilium/operator-aws:v1.11.15@sha256:3aa776003eee064a6896b6ad712f55293d4e045defbe14d3768d224ce254d5c3

operator-azure

docker.io/cilium/operator-azure:v1.11.15@sha256:81e5168c977806a7f310aa57cca74c908fe6ea323518804e15c48bc786b99271
quay.io/cilium/operator-azure:v1.11.15@sha256:81e5168c977806a7f310aa57cca74c908fe6ea323518804e15c48bc786b99271

operator-generic

docker.io/cilium/operator-generic:v1.11.15@sha256:1feed1b895b39c7bdcbfe6232536e26edba9beb41c160c66d539de4358275a2e
quay.io/cilium/operator-generic:v1.11.15@sha256:1feed1b895b39c7bdcbfe6232536e26edba9beb41c160c66d539de4358275a2e

operator

docker.io/cilium/operator:v1.11.15@sha256:97e6df665e10a08b2fbb5aefb183564debe0a0a4108b371a2f4d95f38c56f56c
quay.io/cilium/operator:v1.11.15@sha256:97e6df665e10a08b2fbb5aefb183564debe0a0a4108b371a2f4d95f38c56f56c