Cilium - v1.11.14

The Cilium core team is pleased to announce v1.11.14. These releases include a range of bugfixes and updates Envoy to v1.22.7 to pull in an updated BoringSSL library dependency to address CVE-2023-0286. Several improvements are also included to address bugs in L7 proxy configuration and CiliumEndpoint resource garbage collection.

Summary of Changes

Minor Changes:
* envoy: Bump envoy version to 1.22.7 (Backport PR #23627, Upstream PR #23502, @sayboras)

Bugfixes:
* Added Agent init check that removes all CiliumEndpoints referencing local Node that are not managed. This fixes issues where sometimes CiliumEndpoints referencing still running Pods can become unmanaged during Cilium restart. (Backport PR #23097, Upstream PR #20350, @tommyp1ckles)
* proxy: Fix deadlock in error path of CreateOrUpdateRedirect (Backport PR #23462, Upstream PR #23377, @gandro)

CI Changes:
* .github: set do not use provenance from docker buildx (Backport PR #23462, Upstream PR #23431, @aanm)
* [v1.11] test/k8sT: remove l7_demos test (#23348, @tklauser)
* daemon/cmd: improve stale cilium endpoint error handling. (Backport PR #23097, Upstream PR #22600, @tommyp1ckles)
* test: print log messages that need to be investigated (Backport PR #23462, Upstream PR #23338, @aanm)
* tests: add exception for etcd error (Backport PR #23462, Upstream PR #23334, @aanm)

Misc Changes:
* .github/workflows: add version number in GH action (#23622, @aanm)
* .github/workflows: fix external contribution detection (Backport PR #23462, Upstream PR #23406, @aanm)
* .github/workflows: fix typo in organization parameter (Backport PR #23462, Upstream PR #23424, @aanm)
* .github/workflows: PR labeler fix GH workflow if expression (Backport PR #23627, Upstream PR #23482, @aanm)
* .github/workflows: set right secret name (Backport PR #23462, Upstream PR #23437, @aanm)
* bugtool: Dump envoy metrics for troubleshooting (Backport PR #23627, Upstream PR #22797, @sayboras)
* build(deps): bump actions/cache from 3.2.3 to 3.2.4 (#23455, @dependabot[bot])
* build(deps): bump actions/github-script from 6.3.3 to 6.4.0 (#23416, @dependabot[bot])
* build(deps): bump actions/github-script from 6.3.3 to 6.4.0 (#23510, @dependabot[bot])
* build(deps): bump docker/build-push-action from 3.3.0 to 4.0.0 (#23491, @dependabot[bot])
* build(deps): bump docker/setup-buildx-action from 2.2.1 to 2.4.0 (#23456, @dependabot[bot])
* build(deps): bump docker/setup-buildx-action from 2.4.0 to 2.4.1 (#23594, @dependabot[bot])
* build(deps): bump github/codeql-action from 2.1.39 to 2.2.1 (#23415, @dependabot[bot])
* build(deps): bump github/codeql-action from 2.2.1 to 2.2.2 (#23611, @dependabot[bot])
* build(deps): bump github/codeql-action from 2.2.2 to 2.2.3 (#23650, @dependabot[bot])
* build(deps): bump KyleMayes/install-llvm-action from 1.6.1 to 1.7.0 (#23389, @dependabot[bot])
* chore(deps): update docker.io/library/alpine docker tag to v3.16.4 (v1.11) (#23684, @renovate[bot])
* chore(deps): update docker.io/library/ubuntu:20.04 docker digest to 4a45212 (v1.11) (#23568, @renovate[bot])
* chore(deps): update docker.io/library/ubuntu:20.04 docker digest to b33325a (v1.11) (#23474, @renovate[bot])
* cilium: Fix missing error log dump from compilation (Backport PR #23462, Upstream PR #23339, @borkmann)
* daemon: Do not fail CI runs for already deleted CEP (Backport PR #23097, Upstream PR #22474, @jrajahalme)
* docs: Disable exclusive lock when chaining with aws-cni (Backport PR #23462, Upstream PR #23159, @jaygridley)
* fqdn/dnsproxy: move init LRU cache call out of StartDNSProxy. (Backport PR #23627, Upstream PR #23429, @tommyp1ckles)
* images/runtime: bump iptables package to 1.8.8 (Backport PR #23409, Upstream PR #23163, @jibi)
* Introduce node IDs in the datapath and the agent, so datapath can later use them to identify remote nodes (Backport PR #23627, Upstream PR #23202, @pchaigno)
* iptables: add support for iptables >= 1.8.7 (Backport PR #23409, Upstream PR #21096, @jibi)

Other Changes:
* [v1.11] renovate: Replace update-hubble-version.sh with Renovate Bot (#23531, @gandro)
* install: Update image digests for v1.11.13 (#23401, @qmonnet)
* Pick up etcd v3.4.23 (#23630, @michi-covalent)

Docker Manifests

cilium

docker.io/cilium/cilium:v1.11.14@sha256:9675d8f63c00597b07210bb4a1ffe1952d3997190818da950602798afec7f66d
quay.io/cilium/cilium:v1.11.14@sha256:9675d8f63c00597b07210bb4a1ffe1952d3997190818da950602798afec7f66d

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.11.14@sha256:10429f6e365e2d30f62ba2dd6640b62a220246dc1ce941e2421cd41568332ea5
quay.io/cilium/clustermesh-apiserver:v1.11.14@sha256:10429f6e365e2d30f62ba2dd6640b62a220246dc1ce941e2421cd41568332ea5

docker-plugin

docker.io/cilium/docker-plugin:v1.11.14@sha256:19c08720f0a0993b5149e618ebecafe14bed70b17afe2ba6d0afdb768cba1da4
quay.io/cilium/docker-plugin:v1.11.14@sha256:19c08720f0a0993b5149e618ebecafe14bed70b17afe2ba6d0afdb768cba1da4

hubble-relay

docker.io/cilium/hubble-relay:v1.11.14@sha256:da8dbbf5d15dbc546c082c0a4f6dc643d488858106eb88fa3b53e15ebd4d0398
quay.io/cilium/hubble-relay:v1.11.14@sha256:da8dbbf5d15dbc546c082c0a4f6dc643d488858106eb88fa3b53e15ebd4d0398

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.11.14@sha256:fbce5443d8680b4eb51187723dd4ad82f80625a57687d7b7d1d075650b262aa1
quay.io/cilium/operator-alibabacloud:v1.11.14@sha256:fbce5443d8680b4eb51187723dd4ad82f80625a57687d7b7d1d075650b262aa1

operator-aws

docker.io/cilium/operator-aws:v1.11.14@sha256:56fb4a622f28b481f5bd42cda52bf0c88b4a3dfeb696426eae03829af5eb12f1
quay.io/cilium/operator-aws:v1.11.14@sha256:56fb4a622f28b481f5bd42cda52bf0c88b4a3dfeb696426eae03829af5eb12f1

operator-azure

docker.io/cilium/operator-azure:v1.11.14@sha256:555ce074d96986360c4ecc87b6dea450ffae58b3b4ad97a4627311861f10b9a6
quay.io/cilium/operator-azure:v1.11.14@sha256:555ce074d96986360c4ecc87b6dea450ffae58b3b4ad97a4627311861f10b9a6

operator-generic

docker.io/cilium/operator-generic:v1.11.14@sha256:d48f7aa6dfc7097fe4a0e918b7e57fa7bd4ace1acdceb88b336d608abbe01c33
quay.io/cilium/operator-generic:v1.11.14@sha256:d48f7aa6dfc7097fe4a0e918b7e57fa7bd4ace1acdceb88b336d608abbe01c33

operator

docker.io/cilium/operator:v1.11.14@sha256:5e3da0ece8520c95f252b904de6fd670bba72ef7b0c8eba2cfba992dcc18cb97
quay.io/cilium/operator:v1.11.14@sha256:5e3da0ece8520c95f252b904de6fd670bba72ef7b0c8eba2cfba992dcc18cb97