fix(deps): update module github.com/cilium/cilium to v1.15.0-pre.2

[cilium-renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/cilium/cilium	require	patch	v1.15.0-pre.1 -> v1.15.0-pre.2

---

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.15.0-pre.2: 1.15.0-pre.2

Compare Source

Summary of Changes

Major Changes:

• Support BGP passwords in the Go BGP implementation. (#​23759, @​dgl)

Minor Changes:

• Add flows per second information to Hubble status (#​28205, @​glrf)
• add Ingress controller proxy protocol support (#​28194, @​zetaab)
• Add option to redact http headers (#​26724, @​ChrsMark)
• Added cilium_kvstoremesh_kvstore_sync_errors_counter, cilium_clustermesh_apiserver_kvstore_sync_errors_counter and kvstore_sync_errors_counter metrics that capture data synchronization errors to kvstore. (#​28419, @​marseel)
• Added hubble_relay_pool_peer_connection_status metric for measuring the connection status of all peers. Metric keeps track of number of peers for each possible connectiion status. (#​28217, @​siwiutki)
• Added new ingress.cilium.io/ssl-passthrough annoation for Ingress objects (#​28751, @​youngnick)
• Adds optional configurable jobLabel to cilium-agent, cilium-operator, and hubble serviceMonitors (#​28125, @​rbankston)
• Auth map garbage collection will trigger if last local endpoint of a security identity was removed (#​27697, @​meyskens)
• BGPv1: Set R-bit in graceful restart capability negotiation. (#​28293, @​ArsenyBelorukov)
• bpf: static data: use inline asm to access static data (#​27589, @​ti-mo)
• certmanager: solve CannotRegenerateKey (#​28787, @​universam1)
• cilium ingress should have an option to set the number of trusted loadbalancer hops (#​27952, @​chaunceyjiang)
• Cilium now properly deletes stale (deleted) nodes from the node_connectivity_status and node_connectivity_latency_seconds metrics, reducing metric cardinality. (#​28382, @​derailed)
• cmd: Disable local node routes when endpoint routes are enabled (#​28324, @​gandro)
• Display interfaces used for IPsec decryption in cilium encrypt status. (#​28640, @​pchaigno)
• docs: remove annotations-based l7 visibility (#​28449, @​networkop)
• EgressGW: interface selection is now done with BPF, using --install-egress-gateway-routes is no longer needed. (#​26215, @​jibi)
• ENI: fix calculateExcessIPs excessive calculate of excess ip (#​28467, @​wu0407)
• envoy: Bump envoy version to v1.27.1 (#​28531, @​sayboras)
• envoy: Bump envoy version to v1.27.2 (#​28671, @​mhofstetter)
• fix: Preserve OwnerReferences when updating Ingresses with Load Balancer in shared mode (#​28452, @​bittermandel)
• gateaway-api: Support GRPCRoute resource (#​28654, @​sayboras)
• gateway-api: Add support for multiple request mirrors (#​28342, @​sayboras)
• gateway-api: Bump the version to v1.0.0-rc1 (#​28757, @​sayboras)
• helm: delete AWS iptables in all deployments aside from AWS CNI chaining environments (#​28697, @​nebril)
• Ignore Indexed Job-specific label by default for CID creation:
• batch.kubernetes.io/job-completion-index. (#​28897, @​tosi3k)
• Improve cilium-agent bootstrap time when using cluster-pool ipam. (#​28354, @​marseel)
• Improve helm validation for clustermesh, and allow creating the clustermesh configuration also in kvstore mode (#​28763, @​giorio94)
• Improve the usability of the cilium policy selectors command by including the policy name and namespace in order to easily understand which selector comes from what policy (#​27838, @​christarazi)
• ipam/multipool: Introduce specific ip family annotations for specifying ip pools (#​28244, @​hargrovee)
• ipsec: New Prometheus metrics for XFRM configs (#​28400, @​pchaigno)
• metrics: add bpf_map_capacity metric which provides max size of maps (#​28146, @​tommyp1ckles)
• metrics: Add map pressure metric for auth map (#​28357, @​sayboras)
• Network policies for reserved:ingress identity are now enforced by Cilium Ingress and Gateway API. (#​28126, @​jrajahalme)
• pkg/labels: print all leaf CIDRs, not just the last one. (#​28224, @​squeed)
• policy: Fixed a bug that incorrectly omitted port-protocol policy rules that omitted the "protocol" field. An omitted "protocol" field now, correctly, is the same as using the "ANY" protocol. (#​28703, @​nathanjsweet)
• Reduce "stale identity observed" warnings (#​27894, @​leblowl)
• Remove deprecated policy_import_errors_total metric (#​28423, @​tklauser)
• Rename the CLI for local Cilium API access to 'cilium-dbg' (#​28085, @​joestringer)
• Replace LB-IPAM IP allocator to remove limitations and enable additional features (#​26488, @​dylandreimerink)
• Structured Health Reporter + EndpointManager Modular Health Checks (#​27522, @​tommyp1ckles)

Bugfixes:

• Always replace the cilium_call_* tail call map during upgrade/restart to avoid "Missed tail call" errors (#​28740, @​ti-mo)
• backporting: Revert changes until the new workflow will be in place (#​28371, @​pippolo84)
• bpf: fixes an issue where inserting inner maps into an outer may fail with EINVAL due to flags mismatch (#​28710, @​ldelossa)
• bpf: overlay: fix missing DBG_DECAP for Inter-Cluster-SNAT (#​28466, @​julianwiedmann)
• Don't bind a /64 address to cilium_host to avoid misrouting cross-node traffic (#​28633, @​CallMeFoxie)
• Don't orphan CEPs when node IPV6 is preferred at dual stack k8s config (#​28142, @​rawmind0)
• envoy: fix lb backend endpoint calculation (#​27923, @​mhofstetter)
• Fix a bug that causes pod-to-pod traffic between nodes to be dropped when IPsec is enabled and kube-proxy installed rules in both iptables-nft and iptables-legacy. (#​28258, @​pchaigno)
• Fix CIDR labels computation (#​28788, @​pippolo84)
• Fix concurrency issue when changing labels on pods started before Cilium setup their network. Cilium will now process pod labels modified while setting up the pod network. (#​28789, @​aanm)
• Fix Helm rendering for dashboards.enabled=true (#​28542, @​bakito)
• Fix incorrect logic used by the Ingress Controller to sync Cilium's IngressClass on startup. (#​28663, @​learnitall)
• Fix issue causing KVStoreMesh metrics to be included in the dedicated Service/ServiceMonitor when KVStoreMesh is disabled (#​28481, @​giorio94)
• Fix wrong host and router IP being used for some IPv6 deployments, which was causing various connectivity problems. (#​28417, @​ti-mo)
• Fix wrong host and router IP being used for some IPv6 deployments, which was causing various connectivity problems. (Backport PR #​28500, Upstream PR #​28417, @​ti-mo)
• fix: Correct spire labels identation in helm chart (#​28610, @​sayboras)
• Fix: Gateway API double slash while stripping path prefix (#​28294, @​nxy7)
• fixed cilium-operator delete CEC cilium-ingress when other ingressclass resources are created (#​28638, @​chaunceyjiang)
• gateway-api: fix empty URI when removing path prefix (#​28606, @​dddddai)
• helm: Correct command for initContainer config (#​28613, @​sayboras)
• Improved event handling for pod events by removing an unnecessary early return, allowing unrelated components to execute correctly, while enhancing ipcache error logging. (#​28840, @​aanm)
• ipcache: fix flapping labels in SelectorCache when reserved:host identity has multiple IPs (#​28332, @​squeed)
• pkg/k8s: use a deep copy of CNP in UpdateStatus to avoid race condition (#​28364, @​aanm)
• Print full labelset for all identities in 'cilium ip list' output (#​28425, @​joestringer)
• Remove AWS-CONNMARK-CHAIN iptable rules when running in ENI mode. (#​28676, @​nebril)
• resource: Fix race condition in handling of Kubernetes object delete event retrying. In the very rare case when an object was created, deleted and re-created with the same name and the handling of the first deletion failed, the handling of delete event may have been retried even though the object was re-created. Only affected features using the Resource-library (LB IPAM, Mutual Auth and ClusterMesh). (#​27340, @​joamaki)
• srv6: modify h.encap location in the datapath to avoid incompatibility with IPv4Masq (#​28817, @​ldelossa)
• When the CT entry for a DSR connection is garbage-collected, the corresponding SNAT entry is now also removed. (#​28857, @​julianwiedmann)

CI Changes:

• .github: bump k8s version from v1.28.0 -> v1.28.2. (#​28664, @​tommyp1ckles)
• .github: re-use common helm values from a single action (#​28180, @​aanm)
• Add initial, in-progress workflow for automated scale testing (#​28362, @​learnitall)
• Add time wrapper to test agent delays in CI (#​27253, @​joestringer)
• bgpv1,ci: Fix BGP component tests reusing the same VirtualRouter config (#​28420, @​rastislavs)
• ci: Add a workflow to update labels of backported PRs (#​27875, @​pippolo84)
• ci: Avoid using deprecated "tunnel" flag (#​28323, @​gandro)
• ci: Enable link checker to ensure that all links in documentation are valid (#​27116, @​vipul-21)
• ci: use renovate to upgrade Helm in ginkgo tests (#​28777, @​nebril)
• Correctly use cli installer action in ipv4/6 smoke (#​28661, @​bleggett)
• Do not hardcode the AWS VPC CNI plugin version in the conformance-aws-cni GHA workflow (#​28392, @​giorio94)
• gateway-api: Disable HTTPRouteRequestMultipleMirrors again (#​28524, @​sayboras)
• gateway-api: Enable CI for multiple mirror feature (#​28838, @​sayboras)
• GHA: Add clustermesh upgrade and downgrade tests (#​27232, @​giorio94)
• GHA: correctly test kvstoremesh in conformance-clustermesh (#​28434, @​giorio94)
• gha: Disable HTTPRouteRequestMultipleMirrors test (#​28396, @​sayboras)
• gha: explicit branch and trigger in ariane-scheduled workflow (#​28432, @​giorio94)
• Setup Renovate for SPIRE deployment (#​27708, @​meyskens)
• Test both VXLAN and GENEVE tunneling as part of the Conformance Cluster Mesh workflow (#​28767, @​giorio94)
• workflows: cilium-config: parametrize egressgw helm values (#​28389, @​jibi)

Misc Changes:

• .github/actions/helm-default: use the derived SHA as image tag (#​28410, @​aanm)
• .github: Fix typo in workflow stage name (#​28504, @​joestringer)
• Add link in maintainers.md and contributing guide to contributor ladder (#​28778, @​xmulligan)
• Add link to getting started guide for kind cluster for common "too many files" issue (#​28522, @​dipankardas011)
• Add Parseable to USERS.md (#​28675, @​nitisht)
• add traffic shifting example for service mesh (#​27845, @​tanjunchen)
• Add workqueue.(delayingType).waitingLoop to goleak exception list (#​28557, @​dylandreimerink)
• address missing binary checks for make dev-doctor. (#​28269, @​fujitatomoya)
• Avoid requiring the latest Go toolchain patch version to build (#​28686, @​joestringer)
• BGP CP: API Helper Functions Cleanup (#​28036, @​danehans)
• bgpv1,ci: Add Test_AdvertisedPathAttributes into BGP component tests (#​28484, @​rastislavs)
• bgpv1,ci: Do not use asserts in Eventually() test conditions (#​28489, @​rastislavs)
• bgpv1: Remove inappropriate comments and fix typo (#​28562, @​hargrovee)
• bigtcp: Modularize and use the devices table (#​28643, @​joamaki)
• bpf: clean up CB_NAT (#​28375, @​julianwiedmann)
• bpf: clean up some drop notifications (#​28431, @​julianwiedmann)
• bpf: conntrack: improve handling of CT_REOPENED result (#​28597, @​julianwiedmann)
• bpf: egressgw: make ct_status an enum (#​28399, @​julianwiedmann)
• bpf: encap: clean up usage of __encap_and_redirect_with_nodeid() (#​28411, @​julianwiedmann)
• bpf: hs-ipcache: use get_id_from_tunnel_id() (#​28508, @​julianwiedmann)
• bpf: ipv4: refactor L4 port extraction for fragmented packets (#​28717, @​julianwiedmann)
• bpf: let set_identity_mark() also set MARK_MAGIC_IDENTITY (#​28665, @​julianwiedmann)
• bpf: lxc: remove stale ENABLE_IDENTITY_MARK ifdefs (#​28391, @​julianwiedmann)
• bpf: overlay: clean up extraction of source identity (#​28608, @​julianwiedmann)
• bpf: s/ipcache_lookup*()/lookup_ip*_remote_endpoint() (#​28805, @​julianwiedmann)
• bugtool: Collect XFRM error counters twice (#​28790, @​pchaigno)
• build(deps): bump urllib3 from 2.0.4 to 2.0.6 in /Documentation (#​28365, @​dependabot[bot])
• build(deps): bump urllib3 from 2.0.6 to 2.0.7 in /Documentation (#​28658, @​dependabot[bot])
• build: Remove envoy from Makefile target (#​28436, @​sayboras)
• Check for cilium.sock in /healthz endpoint (#​28343, @​chaunceyjiang)
• chore(deps): update all github action dependencies (main) (#​28736, @​renovate[bot])
• chore(deps): update all github action dependencies (main) (minor) (#​28616, @​renovate[bot])
• chore(deps): update all github action dependencies (main) (patch) (#​28603, @​renovate[bot])
• chore(deps): update all github action dependencies (main) (patch) (#​28724, @​renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#​28345, @​renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#​28725, @​renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#​28859, @​renovate[bot])
• chore(deps): update cilium/cilium digest to a79241a (main) (#​28721, @​renovate[bot])
• chore(deps): update cilium/cilium digest to ce02445 (main) (#​28629, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.15.10 (main) (#​28460, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.15.10 (main) (#​28604, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.15.11 (main) (#​28624, @​renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.15.9 (#​28406, @​joestringer)
• chore(deps): update dependency cilium/hubble to v0.12.1 (main) (#​28520, @​renovate[bot])
• chore(deps): update dependency cilium/hubble to v0.12.2 (main) (#​28565, @​renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.18.4 (main) (#​28346, @​renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.3 docker digest to 24a0937 (main) (#​28602, @​renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to 2b7412e (main) (#​28722, @​renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to 990350f (main) (#​28578, @​renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to 9b8dec3 (main) (#​28383, @​renovate[bot])
• chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to 91ca472 (main) (#​28468, @​renovate[bot])
• chore(deps): update github/codeql-action action to v2.22.5 (main) (#​28860, @​renovate[bot])
• chore(deps): update go to v1.21.3 (main) (patch) (#​28471, @​renovate[bot])
• chore(deps): update golangci/golangci-lint docker tag to v1.55.0 (main) (#​28728, @​renovate[bot])
• chore(deps): update golangci/golangci-lint docker tag to v1.55.1 (main) (#​28865, @​renovate[bot])
• chore(deps): update quay.io/cilium/hubble docker tag to v0.12.1 (main) (#​28539, @​renovate[bot])
• chore(deps): update quay.io/cilium/hubble docker tag to v0.12.2 (main) (#​28589, @​renovate[bot])
• chore(deps): update quay.io/lvh-images/kind docker tag to bpf-next-20231010.012608 (main) (#​28605, @​renovate[bot])
• chore: Use slices package from Go std lib (#​28614, @​pippolo84)
• chore: Use slices package from Go std lib (#​28822, @​schlosna)
• ci-e2e: add job testing node cidr feature (#​28445, @​squeed)
• cilium node chain refactor (#​26962, @​bimmlerd)
• cilium: Remove platform references for completion (#​28505, @​joestringer)
• Clean up prefix length tracking implementations (#​25153, @​joestringer)
• clustermesh-apiserver/kvstoremesh: unify metrics cell (#​28480, @​giorio94)
• clustermesh-apiserver: extract external workloads in a separate cell (#​28478, @​giorio94)
• CODEOWNERS: assign .github/actions to github-sec and ci-structure (#​28394, @​jibi)
• contrib: Add ContainerLab-based BGP CPlane development environment (#​28292, @​YutaroHayakawa)
• contrib: Fix missing function in post-release.sh (#​28372, @​joestringer)
• correct stats calculation for prepareBuild of endpoint_regeneration_time (#​28150, @​PlatformLC)
• daemon,pkg/service: Use hive cell infra for pkg/service (#​28732, @​rastislavs)
• daemon: Skip Ingress Endpoint on BPF watchdog (#​28462, @​jrajahalme)
• daemon: Uniquely identify daemon ipcache upserts (#​28770, @​joestringer)
• datapath: alignchecker: allow to extend toCheck and toCheckSizes (#​28711, @​jibi)
• datapath: Introduce fake datapath cell (#​28611, @​joamaki)
• dev-doctor command version strings should be array. (#​28801, @​fujitatomoya)
• devices: Remove logging and report reason in device struct (#​28393, @​joamaki)
• Docs: Add BGP Advertised Path Attributes documentation (#​28482, @​rastislavs)
• docs: Add policymap pressure debugging guide (#​27903, @​christarazi)
• Docs: Adds CiliumPodIPPool Special Purpose Selectors (#​28819, @​danehans)
• docs: Clarify BPF Map Pressure Metric (#​28682, @​nathanjsweet)
• docs: fix reference to lvh kind images (#​27376, @​rgo3)
• docs: Mention RouteTableInterfacesOffset in system requirements (#​28358, @​gandro)
• docs: Remove bare URLs from Flow gRPC API Reference (#​28361, @​kimstacy)
• docs: Update IPsec key rotation command (#​28141, @​jschwinger233)
• docs: Update Kubernetes Gateway-API version to v0.8.1 (#​28388, @​haiyuewa)
• Docs: Updates BGP CP for PodIPPoolSelector (#​28312, @​danehans)
• Docs: Updates for Deprecation of CNI network-plugin Flag (#​28046, @​danehans)
• Docs: Updates L2 Announce for LB Class Support (#​28252, @​danehans)
• docs: Use host port for serving docs (#​28307, @​brb)
• Documentation: Consistently use --set for cilium install (#​28577, @​michi-covalent)
• egressgw: doc fixes for install-egress-gateway-routes removal (#​28523, @​lmb)
• egressgw: Switch from net to netip (#​28503, @​joestringer)
• Enable k8s cache mutation detector in the CI (#​28182, @​aanm)
• endpoint/id: use strings.IndexByte (#​28202, @​tklauser)
• envoy: Import Health check sink API (#​28463, @​jrajahalme)
• envoy: Update to a build with health checkers enabled (#​28518, @​jrajahalme)
• example/connectivity-check: fix port conflict, capture termination log (#​28833, @​squeed)
• Extend cilium scale-test to export results and gather additional data (#​28594, @​marseel)
• Fix data race during Hubble setup (#​28322, @​glrf)
• Fix IPv4 checksum recalculation in SNAT flows where ports are rewritten. (#​28768, @​gentoo-root)
• Fix kind targets (#​28548, @​chancez)
• fix(deps): update all go dependencies main (main) (minor) (#​28098, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (minor) (#​28618, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (minor) (#​28730, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (patch) (#​28348, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (patch) (#​28514, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (patch) (#​28615, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (patch) (#​28727, @​renovate[bot])
• fix(deps): update all go dependencies main (main) (patch) (#​28866, @​renovate[bot])
• fix(deps): update module golang.org/x/net to v0.17.0 [security] (main) (#​28546, @​renovate[bot])
• fix: Remove the latest image tag from docs as latest tag is not published (#​28241, @​vipul-21)
• Forcefully terminate stale sockets connected to deleted service backends when socket-lb is enabled, and allow applications to re-connect to active backends. (#​25169, @​aditighag)
• gateway-api: Add conformance profile test (#​28262, @​sayboras)
• gateway-api: De-flake HTTPRouteRequestMultipleMirrors test (#​28488, @​sayboras)
• gateway-api: watch ownerreference to enable stricter reconcilation (#​28641, @​mhofstetter)
• go.mod, vendor: update vishvananda/netlink to latest (#​28779, @​tklauser)
• helm: add hubble UI support for GKE dataplane v2 (#​28709, @​dwalker-sabiogroup)
• Helm: Add possibility to use affinity on certgen job (#​28412, @​seb-lafond)
• Hive obj output improvements (#​28369, @​bimmlerd)
• hive: ModuleID and FullModuleID, use full ID in module health (#​28512, @​joamaki)
• Improve k8s-get-cilium-pod.sh (#​28774, @​timoreimann)
• Improve readability of clustermesh-related log messages (#​28784, @​giorio94)
• Introduce new BGP CRDs to provide a more flexible way to configure BGP in Cilium. (#​28175, @​harsimran-pabla)
• ipam/multipool: Identity allocation via etcd is now supported (#​28617, @​gandro)
• ipam: Remove unused mock function (#​28370, @​gandro)
• ipcache: Fix incorrect source for kube-apiserver in tests (#​28407, @​christarazi)
• ipcache: fix releasing node CIDRs after restoration (#​28620, @​squeed)
• ipsec: Atomically upgrade XFRM states with new output-mark (#​28485, @​pchaigno)
• ipsec: misc cleanups (#​28408, @​julianwiedmann)
• Jobs now report health (#​28677, @​dylandreimerink)
• labels/cidr: Fix slice preallocation size (#​28378, @​pippolo84)
• labels/cidr: Memoize labels for already seen prefixes (#​28465, @​pippolo84)
• labels/cidr: On the fly char replacement for IPv6 (#​28647, @​pippolo84)
• labels: Use slices.Sort instead of sort.Strings (#​28649, @​pippolo84)
• make: add "run-builder" target (#​28587, @​jrajahalme)
• Makefile: add kind-egressgw targets (#​28793, @​jibi)
• Makefile: fix 'fast' make targets (#​28380, @​aanm)
• makefile: fix 'fast' targets for cilium-dbg (#​28547, @​aanm)
• makefile: fix 'make kind' for mac (#​28791, @​f1ko)
• maps/ctmap: simplify ip/port parsing using netip.ParseAddrPort (#​28827, @​tklauser)
• node: Only Add Enabled IPs to Labels (#​28360, @​nathanjsweet)
• None (#​28738, @​saschagrunert)
• operator: introduce cec l7 envoy loadbalancing cell (#​28835, @​mhofstetter)
• operator: introduce gateway api cell (#​28785, @​mhofstetter)
• operator: introduce Ingress cell (#​28794, @​mhofstetter)
• operator: Migrate Cilium Endpoint GC to hive (#​28233, @​alan-kut)
• pkg/pprof: add CODEOWNER (#​28278, @​lmb)
• Prepare for release v1.15.0-pre.1 (#​28336, @​aanm)
• proxy: allow to provide fixed port for DNS proxy via cell (#​28786, @​tklauser)
• README: Update releases (#​28340, @​aanm)
• README: Update releases (#​28689, @​jrajahalme)
• Remove daemon health from being reported via the CLI (#​28404, @​derailed)
• Remove dependencies on linux probes for Windows builds (#​28367, @​glrf)
• renovate: schedule all renovate updates for Monday (#​28585, @​aanm)
• report endpoint ID on endpoint BPF program (#​28747, @​aanm)
• Resiliency: Add checks to ensure endpoint BPF programs remain loaded (#​27981, @​derailed)
• Resiliency: Node manager reconciliation path yields unchecked errors (#​27714, @​derailed)
• resource: Fix flaky TestResource_RepeatedDelete (#​28588, @​joamaki)
• Split mapstate keys into allow and deny (#​28352, @​bimmlerd)
• statedb: Fix watch channel returned by LowerBound (#​28644, @​joamaki)
• StateDB: split write methods from Table into RWTable (#​28140, @​joamaki)
• statedb: Use proper context for graveyard rate limiting (#​28888, @​joamaki)
• typo fix (#​28231, @​yylt)
• Update codeowners for recent lb-ipam / ipalloc changes (#​28803, @​joestringer)
• Update docs theme (#​28403, @​raphink)
• Update ec2 eni limits - current as of Oct 30, 2023 (#​28880, @​michaelsaah)
• update github.com/cilium/ebpf to v0.12.0 (#​28533, @​lmb)
• Update Hubble UI from v0.12.0 to v0.12.1 (#​28532, @​rolinh)
• update k8s dependencies to v0.28.2 (#​28648, @​aanm)
• Update the clustermesh troubleshooting guide (#​26798, @​giorio94)

Docker Manifests

cilium

docker.io/cilium/cilium:v1.15.0-pre.2@​sha256:7f077c49ce091428b04de006d5f4cb01b8e32d63dc1d45fa3e372d624681e836
quay.io/cilium/cilium:v1.15.0-pre.2@​sha256:7f077c49ce091428b04de006d5f4cb01b8e32d63dc1d45fa3e372d624681e836

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.15.0-pre.2@​sha256:19539c7470f27431ee06e4d4bccad40ca206430e3b5f31c8c86cc96e71d85127
quay.io/cilium/clustermesh-apiserver:v1.15.0-pre.2@​sha256:19539c7470f27431ee06e4d4bccad40ca206430e3b5f31c8c86cc96e71d85127

docker-plugin

docker.io/cilium/docker-plugin:v1.15.0-pre.2@​sha256:033f762410bee062c47df96313ffda60683f682db8b562d81614fa7130d3b643
quay.io/cilium/docker-plugin:v1.15.0-pre.2@​sha256:033f762410bee062c47df96313ffda60683f682db8b562d81614fa7130d3b643

hubble-relay

docker.io/cilium/hubble-relay:v1.15.0-pre.2@​sha256:74b20caf534472e274eb020e8ceaf4abfe8d6540c282cb648eb4e0420bccf782
quay.io/cilium/hubble-relay:v1.15.0-pre.2@​sha256:74b20caf534472e274eb020e8ceaf4abfe8d6540c282cb648eb4e0420bccf782

kvstoremesh

docker.io/cilium/kvstoremesh:v1.15.0-pre.2@​sha256:68906ec4ff4577eeaff3a263a68037aae83f6727437e07958c6f7b2cac6b564b
quay.io/cilium/kvstoremesh:v1.15.0-pre.2@​sha256:68906ec4ff4577eeaff3a263a68037aae83f6727437e07958c6f7b2cac6b564b

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.15.0-pre.2@​sha256:a6ff662a0e07a383bc617579ca9ece9c093386a001582bc7588ab1e5b5fdf92e
quay.io/cilium/operator-alibabacloud:v1.15.0-pre.2@​sha256:a6ff662a0e07a383bc617579ca9ece9c093386a001582bc7588ab1e5b5fdf92e

operator-aws

docker.io/cilium/operator-aws:v1.15.0-pre.2@​sha256:81897d31042f34bac5d0d2a25d6dd64f7f294c5711f39ef47ddcb68ef05c1be0
quay.io/cilium/operator-aws:v1.15.0-pre.2@​sha256:81897d31042f34bac5d0d2a25d6dd64f7f294c5711f39ef47ddcb68ef05c1be0

operator-azure

docker.io/cilium/operator-azure:v1.15.0-pre.2@​sha256:01b92fc10fa76117f61f40fdd20c25d45ea8c205979423e2afd911523317e3ce
quay.io/cilium/operator-azure:v1.15.0-pre.2@​sha256:01b92fc10fa76117f61f40fdd20c25d45ea8c205979423e2afd911523317e3ce

operator-generic

docker.io/cilium/operator-generic:v1.15.0-pre.2@​sha256:e5506ddf0665307cf4012a9fbe3f1a51c722b63a12e7abd357119b7c2d1f68af
quay.io/cilium/operator-generic:v1.15.0-pre.2@​sha256:e5506ddf0665307cf4012a9fbe3f1a51c722b63a12e7abd357119b7c2d1f68af

operator

docker.io/cilium/operator:v1.15.0-pre.2@​sha256:060831c979d9eb636e70a51a1e3e5e6eb9f3297492c35b9c6d502a47c11b901e
quay.io/cilium/operator:v1.15.0-pre.2@​sha256:060831c979d9eb636e70a51a1e3e5e6eb9f3297492c35b9c6d502a47c11b901e

---

Configuration

📅 Schedule: Branch creation - "on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.