v1.13.12 release

[michi-covalent]

Setup preparation

• Depending on your OS, make sure Docker is running
• Export a GITHUB_TOKEN that has access to the repository. Only classic tokens are
  supported at the moment, the needed scope is public_repo.
• Make sure a setup (GPG, SSH, S/MIME) is in place for signing tags with Git and install Hub.
• Make sure the GOPATH environment variable is set and pointing to the relevant path
• Make sure the Cilium helm charts and release repositories are installed locally:
  • Run git clone https://github.com/cilium/charts.git "$GOPATH/src/github.com/cilium/charts"
  • Run git clone https://github.com/cilium/release.git "$GOPATH/src/github.com/cilium/release"

    • If you already have the repo checked out, make sure the release binary is up to date:

      git checkout master && git pull && make
      

Pre-release

• Announce in Cilium slack channel #launchpad: Starting vX.Y.Z release process :ship:
  • Create a thread for that message and ping the current backporter to merge the
    outstanding backport PRs and stop merging any new backport PRs until the release
    process is complete (to avoid generating incomplete release notes).
• Change directory to the local copy of cilium/release repository.
• Check that there are no release blockers for the targeted release version.
• Ensure that outstanding backport PRs are merged (these may be skipped on
  case by case basis in coordination with the backporter).
• Check with @cilium/security team if there are any security fixes to include
  in the release.
• Execute release --current-version X.Y.Z --next-dev-version X.Y.W to
  automatically move any unresolved issues/PRs from old release project
  into the new project (W should be calculation of Z+1). The release
  binary is located in the current repository.
  • Check through the list of PRs in the output for any old, unmerged/closed PRs with
    lingering needs-backport labels. Remove the label from any PRs that are no longer
    valid and need backporting. Remove the PR from the new Github Project created for
    the next release.
• Push a PR to cilium/cilium including the changes necessary for the new release:
  • Change directory to the local copy of cilium/cilium repository and pull latest
    changes from the branch being released
  • Run contrib/release/start-release.sh X.Y.Z N, where N is the id of
    the GitHub project created at the previous step. You can ignore
    warnings about commits with no related PR found.
    Note that this script produces some files at the root of the Cilium
    repository, and that these files are required at a later step for
    tagging the release. Do not commit them.
  • Commit all changed files with title Prepare for release vX.Y.Z. New
    generated files, such as release-state.json and vX.Y.Z-changes.txt
    should not be committed. Tip: use git add -p to review the changes and
    compare them with the previous release PR.
  • Submit PR (contrib/release/submit-release.sh). Note that only the smoke tests
    need to succeed in order to merge this PR. Full e2e test runs are not required.
• Merge PR Prepare for release v1.13.12 cilium#30730
• Ask a maintainer if there are any known issues that should hold up the release
• FYI, do not wait too much time between a tag is created and the helm charts are published.
  Once the tags are published the documentation will be pointing to them. Until we release
  the helm chart, users will face issues while trying out our documentation.
• Create and push both tags to GitHub (vX.Y.Z, X.Y.Z)
  • Pull latest upstream/vX.Y branch locally
  • Run contrib/release/tag-release.sh.
• Ask a maintainer to approve the build in the following link (keep the URL
  of the GitHub run to be used later):
  Cilium Image Release builds
  • Check if all docker images are available before announcing the release:
    make -C install/kubernetes/ check-docker-images
• Get the image digests from the build process and make a commit and PR with
  these digests.
  • Run contrib/release/post-release.sh URL to fetch the image
    digests and submit a PR to update these, use the URL of the GitHub
    run here
  • Get someone to review the PR. Do not trigger the full CI suite, but
    wait for the automatic checks to complete. Merge the PR. install: Update image digests for v1.13.12 cilium#30753
• Update helm charts
  • Pull latest branch locally into the cilium repository.
  • Create helm charts artifacts in Cilium charts repository using
    cilium helm release tool for the vX.Y.Z release
    and create a PR with these changes against the charts repository. Make
    sure the generated helm charts point to the commit that contains the
    image digests. Note: If you handle several patch releases at once,
    create one PR per release, to make sure that the corresponding workflow
    action run for each commit. Wait for your PR to be merged before
    creating the other ones for other patch releases, or they will
    conflict.
  • Have a maintainer review and merge your PR.
  • Check the output of the chart workflow and see if the test was
    successful.
• Check draft release from releases page
  • Update the text at the top with 2-3 highlights of the release
  • Check with @cilium/security if the release addresses any open security
    advisory. If it does, include the list of security advisories at the
    top of the release notes.
  • Check whether the new release should be set as the latest release
    (via the checkbox at the bottom of the page). It should be the new
    latest if the version number is strictly superior to the current
    latest release displayed on GitHub (e.g. 1.11.13 does not become the
    new latest release over 1.12.5, but version 1.12.6 will).
  • Publish the release
• Announce the release in #general on Slack (do not use [@]channel)

Post-release

• Prepare post-release changes to main branch using contrib/release/bump-readme.sh. README: Update releases cilium#30784