fix: update cilium (patch)

[tvories-tbot]

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	HelmChart	patch	1.15.7 -> 1.15.12
cilium (source)		patch	1.15.7 -> 1.15.12
quay.io/cilium/cilium		patch	v1.15.8 -> v1.15.12
quay.io/cilium/operator-generic		patch	v1.15.8 -> v1.15.12

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cilium/cilium (cilium)

v1.15.12: 1.15.12

Compare Source

Summary of Changes

Bugfixes:

• bgp: fix race in bgp stores (Backport PR #​36071, Upstream PR #​35971, @​harsimran-pabla)
• cilium-health-ep controller is made to be more robust against successive failures. (Backport PR #​36071, Upstream PR #​35936, @​jrajahalme)
• gateway-api: Fix gateway checks for namespace (Backport PR #​36464, Upstream PR #​35452, @​sayboras)
• Unbreak the cilium-dbg preflight migrate-identity command (Backport PR #​36285, Upstream PR #​36089, @​giorio94)

CI Changes:

• [v1.15] ci: modularize chart CI push workflow (#​35963, @​ferozsalam)
• [v1.15] gha: Upgrade helm/kind-action to the latest upstream (#​36415, @​aanm)
• gha: configure environment in build-images-base/image-digests job (Backport PR #​36464, Upstream PR #​36318, @​giorio94)
• github: Pass the workflow step timeout to go test (Backport PR #​36071, Upstream PR #​35814, @​jrajahalme)
• Remove unnecessary hubble port-forward commands (Backport PR #​36071, Upstream PR #​33523, @​michi-covalent)

Misc Changes:

• [v1.15] docs: egress masquerade selector (#​36407, @​nbusseneau)
• [v1.15] images: bump cni plugins to v1.6.0 (#​36090, @​ferozsalam)
• chore(deps): update all github action dependencies (v1.15) (#​36159, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​36280, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​36449, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​36156, @​cilium-renovate[bot])
• chore(deps): update cilium/little-vm-helper action to v0.0.19 (v1.15) (#​36157, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.22 (v1.15) (#​36506, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/hubble to v1.16.4 (v1.15) (#​36146, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.9 docker digest to 147f428 (v1.15) (#​36223, @​cilium-renovate[bot])
• chore(deps): update go to v1.22.10 (v1.15) (#​36446, @​cilium-renovate[bot])
• chore(deps): update old stable lvh-images (v1.15) (patch) (#​36158, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.7-1733138674-96535afceef9d9f5c28a96cabe4068bf4472d053 (v1.15) (#​36181, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.8-1733718623-70f73cfb053b8039d0541fdd0c120afc5f57a43d (v1.15) (#​36456, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8 (v1.15) (#​36496, @​cilium-renovate[bot])
• chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20241129.013349 (v1.15) (#​36281, @​cilium-renovate[bot])
• chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20241206.013345 (v1.15) (#​36447, @​cilium-renovate[bot])
• docs: In k0s guide, remove dashes to fix invalid Bash variable names. (Backport PR #​36071, Upstream PR #​35923, @​yilas)
• docs: WireGuard doesn't require overlay port in Network Firewalls (Backport PR #​36285, Upstream PR #​36208, @​julianwiedmann)
• envoy: Configure internal_address_config to avoid warning log (Backport PR #​36017, Upstream PR #​35943, @​sayboras)
• fix(deps): update module golang.org/x/crypto to v0.31.0 [security] (v1.15) (#​36531, @​cilium-renovate[bot])
• images: Use cilium-builder image instead of golang to build hubble (Backport PR #​36313, Upstream PR #​35697, @​learnitall)
• Makefile: fix swagger definition for automatic renovate updates (Backport PR #​36071, Upstream PR #​35979, @​aanm)
• Update documentation for egress masquerading behavior (Backport PR #​36464, Upstream PR #​36267, @​liyihuang)

Other Changes:

• [1.15] xdp: make cilium_calls_xdp map per-endpoint (#​36099, @​ti-mo)
• install: Update image digests for v1.15.11 (#​36046, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.12@​sha256:d1793b67d976e1bc0a4ab01b34c94adfcd35a8be7612d04c6d618bf25f50f0d1

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.12@​sha256:96541f82229725e21b036adffffd92270c82b4bc0f8c27795058b5f115ad5bd0

docker-plugin

quay.io/cilium/docker-plugin:v1.15.12@​sha256:f564af976d82c09e37f17945e7de9bfc17f76a7f0f4d5529795c22d3fffd2adb

hubble-relay

quay.io/cilium/hubble-relay:v1.15.12@​sha256:19a6458a8ea824052fe74ff06f37222f42e72df41f06b548fe07b9a22daa1203

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.12@​sha256:f62872cb96278159e968e3f384ad2ebab30eef9335c2a3838c5bc0bc528398ce

operator-aws

quay.io/cilium/operator-aws:v1.15.12@​sha256:a9d63cbd89e0c7ccf46460809b95e37045092dd297a1bc934afa19a83f4884aa

operator-azure

quay.io/cilium/operator-azure:v1.15.12@​sha256:a89046318bbb87f9ae357566dab448871384cfc7797ef2a3c31abd903d9ec8dc

operator-generic

quay.io/cilium/operator-generic:v1.15.12@​sha256:e48d863367bfd39843917400aa7454ca6a4af74f995cf29a2edb81d7d13c7277

operator

quay.io/cilium/operator:v1.15.12@​sha256:3c40d1c94de94629c02c2c8ee8b69ee6e16c9e60e94ecd343e2a48ebf4a6c430

v1.15.11: 1.15.11

Compare Source

Summary of Changes

Minor Changes:

• hubble-relay: Return underlying connection errors when connecting to peer manager (Backport PR #​35778, Upstream PR #​35632, @​chancez)

Bugfixes:

• config: Remove superfluous warning on native routing CIDR (Backport PR #​35778, Upstream PR #​35738, @​gandro)
• Fix packet drops for pod-to-pod connections that pass through ingress & egress proxy when using IPsec, caused by MTU misconfiguration. (Backport PR #​35586, Upstream PR #​35173, @​smagnani96)
• Fix redirect from L3 device to remote endpoint via overlay network. (Backport PR #​35586, Upstream PR #​35165, @​julianwiedmann)
• Fixed bug which prevented IP surge allocation from working (Backport PR #​35419, Upstream PR #​34090, @​dlapcevic)
• ipam: Validate CiliumNode resource in ENI mode (Backport PR #​35793, Upstream PR #​35784, @​sayboras)
• l7lb: fix registration of flag loadbalancer-l7 (Backport PR #​35778, Upstream PR #​35623, @​mhofstetter)

CI Changes:

• .github/conformance-ginkgo: replace deprecated jq flag (Backport PR #​35469, Upstream PR #​35399, @​aanm)
• Additionally test KVStore mode in E2E/IPSec workflows (Backport PR #​35909, Upstream PR #​35679, @​giorio94)
• ci: conformance-kind: re-enable flaky Aggregator test (Backport PR #​35586, Upstream PR #​35286, @​julianwiedmann)
• gha: Correct number of connect retry param in LVH (Backport PR #​35778, Upstream PR #​32598, @​sayboras)
• gha: Update chmod command (Backport PR #​35469, Upstream PR #​35400, @​sayboras)
• Refactor and set a default for GH_RUNNER_EXTRA_POWER (Backport PR #​35320, Upstream PR #​35267, @​aanm)

Misc Changes:

• .github/build-images-base: checkout base branch to get scripts (Backport PR #​35320, Upstream PR #​35236, @​aanm)
• .github: remove retention days for image digests (Backport PR #​35469, Upstream PR #​35457, @​aanm)
• Accurately manage the teardown sequence of an Endpoint's BPF resources (Backport PR #​35786, Upstream PR #​32167, @​ti-mo)
• chore(deps): update all github action dependencies (v1.15) (#​35387, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​35444, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​35576, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​35711, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​35442, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​35663, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​35914, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/hubble to v1.16.3 (v1.15) (#​35664, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.8 docker digest to 0ca97f4 (v1.15) (#​35443, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.8 docker digest to b274ff1 (v1.15) (#​35383, @​cilium-renovate[bot])
• chore(deps): update go to v1.22.9 (v1.15) (#​35846, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1729635771-fa4efeff33a344a45e14a4068c61dc438b3d2270 (v1.15) (#​35492, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1729775735-a37f7d6081718666dab500533cfda5cecb4febf5 (v1.15) (#​35547, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.7-1730450803-0a83534f8c57b4d24405b213ed4b65e4e4987d8d (v1.15) (#​35715, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.30.7-1730965050-cd22d9ffa21eb4f214bf059bcc5d2f40f0c47882 (v1.15) (#​35836, @​cilium-renovate[bot])
• cilium: Small health cleanup improvements (Backport PR #​35639, Upstream PR #​33700, @​borkmann)
• dnsproxy: fix error when sessionUDPFactory fails (Backport PR #​35586, Upstream PR #​33998, @​marseel)
• docs: Change invalid Helm option --agent.enabled with --agent=false in upgrade documentation (Backport PR #​35320, Upstream PR #​35288, @​oneumyvakin)
• docs: tuning: XDP LB also supports tunnel routing (Backport PR #​35586, Upstream PR #​35574, @​julianwiedmann)
• Envoy simplify listener setup (Backport PR #​35766, Upstream PR #​35642, @​jrajahalme)
• envoy: Configure internal_address_config to avoid warning log (Backport PR #​35472, Upstream PR #​35090, @​sayboras)
• fqdn: Skip "open ports" check for statically configured ports (Backport PR #​35948, Upstream PR #​33230, @​gandro)
• image: Use cilium-builder instead of golang as operator builder image (Backport PR #​35586, Upstream PR #​35351, @​learnitall)
• ipam: lower loglevel from error to warn if eni link list can't be listed (Backport PR #​35469, Upstream PR #​32602, @​mhofstetter)
• makefile: add target to install Cilium in kvstore mode (Backport PR #​35909, Upstream PR #​35646, @​giorio94)
• Makefile: Refactor hubble-relay target (Backport PR #​35320, Upstream PR #​29867, @​chancez)
• Proxy persist proxy ports (Backport PR #​35684, Upstream PR #​32973, @​jrajahalme)
• proxy: Ensure proxy ports are written on shutdown (Backport PR #​35939, Upstream PR #​35839, @​jrajahalme)

Other Changes:

• [v1.15] tests-e2e-upgrade: No longer use secondary network for test 14 (#​35969, @​gandro)
• [v1.15] .github: Fix missing variable escaping in LVH command (#​35893, @​gandro)
• [v1.15] envoy: Bump envoy version from 1.29.x to 1.30.x (#​35564, @​sayboras)
• install: Update image digests for v1.15.10 (#​35360, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.11@​sha256:4444c963c586dd29c9219f4f984b87b7d6f7ee5c0ce650b442111a6ab602b00f

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.11@​sha256:62a4aa3467fa94de65cc01bbbac97484edeee14f7510af7e096b51ab79a6ff71

docker-plugin

quay.io/cilium/docker-plugin:v1.15.11@​sha256:3a9c057f13d9447732ac12373286d23acab5024ce39ce9797ce3b05df43a53ff

hubble-relay

quay.io/cilium/hubble-relay:v1.15.11@​sha256:d352d3860707e8d734a0b185ff69e30b3ffd630a7ec06ba6a4402bed64b4456c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.11@​sha256:62d67aafbfdc9faa4af1c7a1cae39ae61cf151da414670d317c7e2d60820b3de

operator-aws

quay.io/cilium/operator-aws:v1.15.11@​sha256:88088886ab884441c190211d25cae9056f2f4a26e9dcb857c020324062831ab6

operator-azure

quay.io/cilium/operator-azure:v1.15.11@​sha256:b80f4239af8617fa5ea131cedf5c2d3e3375b91916f69e348993a535f7c1fbc3

operator-generic

quay.io/cilium/operator-generic:v1.15.11@​sha256:8edf16ce4bc5c02457136cf0e7a58adf396f0880d6192ca0666f116f53f4979d

operator

quay.io/cilium/operator:v1.15.11@​sha256:945b54e27f3216e35e30b66d653de0517426e14a4e9200fd10cb73f5852e1b4a

v1.15.10: 1.15.10

Compare Source

Summary of Changes

Minor Changes:

• bpf: do not invoke llc from Makefiles (Backport PR #​35168, Upstream PR #​29459, @​lmb)

Bugfixes:

• bugtool: fix cilium-health command (Backport PR #​35276, Upstream PR #​35068, @​ayuspin)
• Fix a bug in Cilium's kube-proxy replacement, where replies by a local backend are dropped with DROP_NO_FIB. (Backport PR #​34917, Upstream PR #​34303, @​julianwiedmann)
• Fix issue where bpf packet buffer mark would in some cases set incorrect mark value resulting in incorrectly SNATed traffic. (Backport PR #​35037, Upstream PR #​34789, @​tommyp1ckles)
• Fixed bug in LB-IPAM where restarting the operator would unshare previously shared IPs between services (Backport PR #​35037, Upstream PR #​34783, @​dylandreimerink)
• Fixed bug in tracking policy changes that could have resulted in revert not woking in failure cases as expected. (Backport PR #​35276, Upstream PR #​35109, @​jrajahalme)
• Fixed bug where service id allocator would loop infinity when out of service ids (Backport PR #​35276, Upstream PR #​35033, @​WeeNews)
• Fixes deadlock in identity watcher. This fixes an issue where a kvstore disconnect can cause the event receiver to exit and the event sender to get stuck forever. (Backport PR #​35276, Upstream PR #​34611, @​dboslee)
• Fixes startup fatal error when updating CiliumNode resource. (Backport PR #​34917, Upstream PR #​34862, @​harsimran-pabla)
• gateway-api: Align GRPCRoute matchers with GEP specification (Backport PR #​35276, Upstream PR #​34808, @​cfsnyder)

CI Changes:

• .github/lint-build-commits: fix workflow for push events (Backport PR #​35276, Upstream PR #​35264, @​aanm)
• .github: create cache directories on cache miss (Backport PR #​35168, Upstream PR #​35088, @​aanm)
• .github: do not push floating tag from PRs (Backport PR #​35168, Upstream PR #​35227, @​aanm)
• .github: install golang action after checkout (Backport PR #​35168, Upstream PR #​34843, @​aanm)
• .github: re-enable configurations in e2e-upgrade (Backport PR #​35168, Upstream PR #​34800, @​aanm)
• .github: specify cache-dependency-path in lint-workflows (Backport PR #​35168, Upstream PR #​34845, @​aanm)
• [v1.15] ci: fix check generated documentation (#​35261, @​mhofstetter)
• ci: conformance-[gateway-api|ginkgo|ingress] wait for images before matrix generation (Backport PR #​34917, Upstream PR #​34820, @​aanm)
• ci: increase wait duration after upgrade/downgrade in E2E upgrade test (Backport PR #​35168, Upstream PR #​32528, @​mhofstetter)
• fix: repository nil value handled on workflow_dispatch context for renovate updates (Backport PR #​34917, Upstream PR #​34902, @​Artyop)
• servicemesh, ci: run internal to NodePort test (Backport PR #​35276, Upstream PR #​35177, @​marseel)

Misc Changes:

• .github: add cache to cilium-cli and hubble-cli build workflows (Backport PR #​35168, Upstream PR #​34847, @​aanm)
• .github: clean up disk for lint-build workflow (Backport PR #​35168, Upstream PR #​35141, @​aanm)
• .github: fix build image process to commit changes (Backport PR #​35276, Upstream PR #​35262, @​aanm)
• .github: fix lvh-kind warnings (Backport PR #​35168, Upstream PR #​34811, @​aanm)
• .github: fix runtime image digests (Backport PR #​35118, Upstream PR #​35107, @​aanm)
• [v1.15] helm: bump certgen to v0.1.15 (#​35034, @​kaworu)
• Change GH runners to GH's default (Backport PR #​35168, Upstream PR #​33451, @​aanm)
• chore(deps): update all github action dependencies (v1.15) (#​35027, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​35092, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​35251, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​35026, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.18 (v1.15) (#​35000, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.19 (v1.15) (#​35202, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/hubble to v1.16.2 (v1.15) (#​35241, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.7 docker digest to ddad330 (v1.15) (#​35091, @​cilium-renovate[bot])
• chore(deps): update go to v1.22.8 (v1.15) (#​35203, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1727272937-c0c0c5f38d338b330d891b304ab5ed6c6d7bcec4 (v1.15) (#​35083, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1727741018-e3a7412f65722ebbe34254b3582b89d315765d0d (v1.15) (#​35138, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1727997080-b094128ed01b784b63ada19b54f8c7fdc3042e6e (v1.15) (#​35219, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.29.9-1728346947-0d05e48bfbb8c4737ec40d5781d970a550ed2bbd (v1.15) (#​35284, @​cilium-renovate[bot])
• helm: set key usages for hubble certificates with cert-manager (Backport PR #​35037, Upstream PR #​34946, @​kaworu)
• images/builder: get rid of annoying git ownership warnings (Backport PR #​35276, Upstream PR #​31538, @​ti-mo)
• Improve speed on lint commits GH workflow (Backport PR #​35168, Upstream PR #​34848, @​aanm)
• Re-write GitHub cache usages across workflows (Backport PR #​35168, Upstream PR #​34866, @​aanm)
• Remove conformance-e2e tests (Backport PR #​35168, Upstream PR #​34742, @​aanm)

Other Changes:

• [v1.15] test/k8s: replace L7 visibility Pod annotations by L7 visibility policy (#​35152, @​tklauser)
• install: Update image digests for v1.15.9 (#​35051, @​cilium-release-bot[bot])
• policy: Fix breakages on v1.15 branch (#​35300, @​christarazi)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.10@​sha256:cd096a343861d48e2849b403f0c410bfbb36e64d042f0692b73b93c97d94d9bd

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.10@​sha256:0d8d5490fa6097d4e7539ffcec705dd25f3f992f29528d6ec999497a02cb1399

docker-plugin

quay.io/cilium/docker-plugin:v1.15.10@​sha256:2cb1f30f87c29d5f98b7a59f743c40a1474d2b1e615153a6799a92389d1aa074

hubble-relay

quay.io/cilium/hubble-relay:v1.15.10@​sha256:d4378eb133a6bdf39f50d874b59b72f95d0da2e78bd545b3c053f3c479f593b2

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.10@​sha256:c78ac42e043f9e77172250a1b6997bbcd8356bb8fe7a4784deaea049207ceb9f

operator-aws

quay.io/cilium/operator-aws:v1.15.10@​sha256:c1af1bae559cd0dd9a1867a4ede95f1fef07e3de173b2b82638ebd7d91256ea0

operator-azure

quay.io/cilium/operator-azure:v1.15.10@​sha256:6cd04b35320824a50b43aa5d7fbfa6d11826f6c5ec8e4853da04a28aa3531695

operator-generic

quay.io/cilium/operator-generic:v1.15.10@​sha256:2f49dca6f9692e317601ae8b5bad7d2dc50cedad38cc8d410db14c1fc57719e4

operator

quay.io/cilium/operator:v1.15.10@​sha256:d1c10ea451c3b3d6cd62984fa653974482ffe8e083497f4e4b011d8ab5dbe964

v1.15.9: 1.15.9

Compare Source

We are happy to release Cilium v1.15.9!

This release brings us upstream filter chains for L7 LB policy enforcement, BGP (and other!) bugfixes, CI changes and many many more!

Check out the summary below for details.

Summary of Changes

Minor Changes:

• cilium-envoy now uses upstream filter chains for L7 LB policy enforcement. (Backport PR #​34457, Upstream PR #​32119, @​jrajahalme)
• docs: Update examples for CNP L7 Host (Backport PR #​34645, Upstream PR #​34578, @​sayboras)

Bugfixes:

• BGPv1 + BGPv2: Fix incorrect service reconciliation in setups with multiple BGP instances (virtual routers) (#​34331, @​rastislavs)
• config: fix disabling config 'Debug' (Backport PR #​34470, Upstream PR #​34401, @​mhofstetter)
• daemon: Fix error logic flow for pod store being out of date (Backport PR #​34587, Upstream PR #​34389, @​christarazi)
• envoy: fix log level mapping when changing log level via API (Backport PR #​34456, Upstream PR #​34400, @​mhofstetter)
• Fix synchronization of CiliumEndpointSlices when running the Cilium Operator in identity-based slicing mode. (Backport PR #​34456, Upstream PR #​32239, @​thorn3r)
• Fix the Egress Gateway reconciliation logic to make progress after setting the rp_filter sysctl failed. (Backport PR #​34830, Upstream PR #​34775, @​julianwiedmann)
• helm: fix envoy prometheus metrics scraping with servicemonitor (Backport PR #​34473, Upstream PR #​34448, @​mhofstetter)
• ingress: Avoid opening of port 80 for TLSPassthrough only (Backport PR #​34598, Upstream PR #​34474, @​sayboras)
• ipcache: Yet another refcounting fix with mix of APIs (Backport PR #​34933, Upstream PR #​34715, @​gandro)
• lbipam: fix panic when changing the shared key & req. ip annotation (Backport PR #​34456, Upstream PR #​34236, @​mhofstetter)

CI Changes:

• .github: change nick-invision/retry -> nick-fields/retry. (#​34736, @​michi-covalent)
• bgpv1/test: fix route matching in PodIPPoolAdvert test (Backport PR #​34456, Upstream PR #​34270, @​rastislavs)
• ci: clean disk only on ubuntu-latest runners (Backport PR #​34830, Upstream PR #​34711, @​marseel)
• ci: Confromance E2E wait for images before matrix generation (Backport PR #​34830, Upstream PR #​34707, @​marseel)
• ci: don't run AKS tests on LTS versions (Backport PR #​34645, Upstream PR #​34640, @​marseel)
• ci: multi pool run tests concurrently (Backport PR #​34299, Upstream PR #​33945, @​viktor-kurchenko)
• ci: Wait for images before generating test matrix (Backport PR #​34830, Upstream PR #​34727, @​marseel)
• Fix: push PR changes when renovate build images under the workflow_call context (Backport PR #​34830, Upstream PR #​34650, @​Artyop)
• gha: Add disk cleanup step for build and test workflow (Backport PR #​34456, Upstream PR #​34339, @​sayboras)
• gha: Free up Github runner disk space (Backport PR #​34299, Upstream PR #​34247, @​sayboras)

Misc Changes:

• Add source IP visibility info to Ingress and Gateway API docs (Backport PR #​34299, Upstream PR #​34137, @​youngnick)
• Add source IP visibility info to Ingress and Gateway API docs (Backport PR #​34367, Upstream PR #​34137, @​youngnick)
• chore(deps): update all github action dependencies (v1.15) (#​34571, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (#​34750, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (patch) (#​34570, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​34696, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.15) (#​34904, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.15 (v1.15) (#​34119, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.16 (v1.15) (#​34507, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.17 (v1.15) (#​34884, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/hubble to v1.16.1 (v1.15) (#​34851, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.19.4 (v1.15) (#​34761, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.7 docker digest to 4594271 (v1.15) (#​34900, @​cilium-renovate[bot])
• chore(deps): update go to v1.22.7 (v1.15) (#​34733, @​cilium-renovate[bot])
• chore: Avoid docker warning due to casing (Backport PR #​34857, Upstream PR #​34125, @​sayboras)
• cilium-dbg: add Envoy admin commands (Backport PR #​34587, Upstream PR #​34398, @​mhofstetter)
• docs: Avoid using wildcard TLS certificate (Backport PR #​34830, Upstream PR #​34609, @​sayboras)
• docs: Improve Ingress documentation (Backport PR #​34367, Upstream PR #​33698, @​youngnick)
• Documentation: Update readthedocs configuration (Backport PR #​34299, Upstream PR #​34190, @​joestringer)
• endpoint: Do not pass a function to WithFields (Backport PR #​34456, Upstream PR #​34346, @​jrajahalme)
• fix: base image update workflow will now be triggered on renovate branches with a workflow_call event type (Backport PR #​34456, Upstream PR #​34372, @​Artyop)
• images: fix path script (Backport PR #​34767, Upstream PR #​34764, @​aanm)
• ipsec: Document a new cause of XfrmInStateProtoError (Backport PR #​34587, Upstream PR #​34221, @​jschwinger233)
• pkg/endpointmanager: don't hold lock while iterating over subscribers (Backport PR #​34587, Upstream PR #​33896, @​aanm)

Other Changes:

• [v1.15] CODEOWNERS: switch cilium/tophat to cilium/committers (#​34889, @​julianwiedmann)
• [v1.15] envoy: Bump envoy version from v1.29.7 to v1.29.9 (#​34965, @​sayboras)
• [v1.15] envoy: Switch to image with timestamp tag (#​34394, @​sayboras)
• envoy: Bump golang version (#​34327, @​sayboras)
• install: Update image digests for v1.15.8 (#​34376, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.15.9@​sha256:c2a4c57a6baf758e975fbefbf638476906d1bb0c970e9547d216d9ea7b6471e3

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.9@​sha256:ec82fb96dd0fbac4c6de333aaf8f7964a74c2194a3afdf765b3c260433a4aeed

docker-plugin

quay.io/cilium/docker-plugin:v1.15.9@​sha256:1a86463fd5b38b5930069045af141ee577ead4c26f8ba4d4a532d1aa3f38a709

hubble-relay

quay.io/cilium/hubble-relay:v1.15.9@​sha256:421afd9f4e46a7b9834f0542ceca6e8652ec0598982126dc2dd1dcf0dd690631

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.9@​sha256:9fe2c3c6d49d4f501067ec525a3d792da17d055ebcefa37f4fbb5698109d217b

operator-aws

quay.io/cilium/operator-aws:v1.15.9@​sha256:8c2b4a4d4d6ebf1c37a6ae72da2279286729a4982bf124d98f4bcc2db5eeb5e6

operator-azure

quay.io/cilium/operator-azure:v1.15.9@​sha256:9b02e12c56b08d50eb1540d6cbb1119eee639a9795c752c4904311d03889d7fe

operator-generic

quay.io/cilium/operator-generic:v1.15.9@​sha256:0ec30b4df0d097aedcbcb41748f10ce397f9656c128bea7e227b6bfd820f6d76

operator

quay.io/cilium/operator:v1.15.9@​sha256:9ed87c339762c5b5422bd284e9672f6fedcee2aba376a5aa1328223c39bd9914

v1.15.8: 1.15.8

Compare Source

Security Advisories

This release addresses the following security vulnerabilities:

• GHSA-vwf8-q6fw-4wcm
• GHSA-qcm3-7879-xcww
• GHSA-q7w8-72mr-vpgw

Summary of Changes

Minor Changes:

• helm: Add validation to prevent users from using deprecated values that have been removed (#​34213, @​chancez)
• helm: Cleanup old k8s version check and deprecated atributes (Backport PR #​34157, Upstream PR #​31940, @​sayboras)
• Make hubble-relay more resilient to transient errors (Backport PR #​34157, Upstream PR #​33894, @​chancez)

Bugfixes:

• add support for validation of stringToString values in ConfigMap (Backport PR #​33962, Upstream PR #​33779, @​alex-berger)
• auth: Fix data race in Upsert (Backport PR #​34157, Upstream PR #​33905, @​chaunceyjiang)
• auth: fix fatal error: concurrent map iteration and map write (Backport PR #​33809, Upstream PR #​33634, @​chaunceyjiang)
• cert: Adding H2 Protocol Support when Get gRPC Config For Client (Backport PR #​33809, Upstream PR #​33616, @​mrproliu)
• DNS Proxy: Allow SO_LINGER to be set to the socket to upstream (Backport PR #​33809, Upstream PR #​33592, @​gandro)
• Fix an issue in updates to node addresses which may have caused missing NodePort frontend IP addresses. May have affected NodePort/LoadBalancer services for users running with runtime device detection enabled when node's IP addresses were changed after Cilium had started.
  Node IP as defined in the Kubernetes Node is now preferred when selecting the NodePort frontend IPs. (Backport PR #​33818, Upstream PR #​33629, @​joamaki)
• Fix bug causing etcd upsertion/deletion events to be potentially missed during t

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[tvories-tbot]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ YAML	prettier	5		0	0.6s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by

[tvories-tbot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.