Prepare for release v1.15.8

Signed-off-by: Cilium Release Bot <noreply@cilium.io>

Author: Cilium Release Bot

AUTHORS

@@ -20,7 +20,7 @@ Alban Crequy                            alban@kinvolk.io
 Aleksander Mistewicz                    amistewicz@google.com
 Aleksei Zakharov                        zakharov.a.g@yandex.ru
 Alexander Alemayhu                      alexander@alemayhu.com
-Alexander Berger                        alex-berger@users.noreply.github.com
+Alexander Berger                        alex-berger@gmx.ch
 Alexander Block                         ablock84@gmail.com
 Alexandre Perrin                        alex@isovalent.com
 Alexei Starovoitov                      alexei.starovoitov@gmail.com
@@ -140,6 +140,7 @@ Christopher Schmidt                     fakod666@gmail.com
 Chris Werner Rau                        cwrau@cwrau.info
 ChrsMark                                chrismarkou92@gmail.com
 Cilium Imagebot                         noreply@cilium.io
+Cilium Release Bot                      noreply@cilium.io
 Cintia Sanchez Garcia                   cynthiasg@icloud.com
 CJ Virtucio                             cjv287@gmail.com
 Claudia J. Kang                         claudiajkang@gmail.com
@@ -298,6 +299,7 @@ huangxuesen                             huangxuesen@kuaishou.com
 Hui Kong                                hui.kong@qunar.com
 Hunter Massey                           hmassey@tradestation.com
 Husni Alhamdani                         dhanielluis@gmail.com
+Huweicai                                i@huweicai.com
 hxysayhi                                51870525+hxysayhi@users.noreply.github.com
 Ian Vernon                              ian@cilium.io
 Ifeanyi Ubah                            ify1992@yahoo.com
@@ -427,6 +429,7 @@ Madhu Challa                            madhu@cilium.io
 Madhusudan.C.S                          madhusudancs@gmail.com
 Mahadev Panchal                         mahadev.panchal@benisontech.com
 MaiReo                                  sawako.saki@gmail.com
+Mais                                    mai.saleh@siemens.com
 Maksym Lushpenko                        iviakciivi@gmail.com
 Manali Bhutiyani                        manali@covalent.io
 Mandar U Jog                            mjog@google.com
@@ -500,6 +503,7 @@ Mohit Marathe                           mohitmarathe23@gmail.com
 Moritz Eckert                           m1gh7ym0@gmail.com
 Moritz Johner                           beller.moritz@googlemail.com
 Moshe Immerman                          moshe.immerman@vitalitygroup.com
+mrproliu                                741550557@qq.com
 Natalia Reka Ivanko                     natalia@isovalent.com
 Nate Sweet                              nathanjsweet@pm.me
 Nate Taylor                             ntaylor1781@gmail.com

CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## v1.15.8
+
+Summary of Changes
+------------------
+
+**Minor Changes:**
+* helm: Add validation to prevent users from using deprecated values that have been removed (cilium/cilium#34213, @chancez)
+* helm: Cleanup old k8s version check and deprecated atributes (Backport PR #34157, Upstream PR #31940, @sayboras)
+* Make hubble-relay more resilient to transient errors (Backport PR #34157, Upstream PR #33894, @chancez)
+
+**Bugfixes:**
+* add support for validation of stringToString values in ConfigMap (Backport PR #33962, Upstream PR #33779, @alex-berger)
+* auth: Fix data race in Upsert (Backport PR #34157, Upstream PR #33905, @chaunceyjiang)
+* auth: fix fatal error: concurrent map iteration and map write (Backport PR #33809, Upstream PR #33634, @chaunceyjiang)
+* cert: Adding H2 Protocol Support when Get gRPC Config For Client (Backport PR #33809, Upstream PR #33616, @mrproliu)
+* DNS Proxy: Allow SO_LINGER to be set to the socket to upstream (Backport PR #33809, Upstream PR #33592, @gandro)
+* Fix an issue in updates to node addresses which may have caused missing NodePort frontend IP addresses. May have affected NodePort/LoadBalancer services for users running with runtime device detection enabled when node's IP addresses were changed after Cilium had started. Node IP as defined in the Kubernetes Node is now preferred when selecting the NodePort frontend IPs. (Backport PR #33818, Upstream PR #33629, @joamaki)
+* Fix bug causing etcd upsertion/deletion events to be potentially missed during the initial synchronization, when Cilium operates in KVStore mode, or Cluster Mesh is enabled. (Backport PR #34183, Upstream PR #34091, @giorio94)
+* Fix issue in picking node IP addresses from the loopback device. This fixes a regression in v1.15 and v1.16 where VIPs assigned to the lo device were not considered by Cilium. Fix spurious updates node addresses to avoid unnecessary datapath reinitializations. (Backport PR #34086, Upstream PR #34012, @joamaki)
+* Fix rare race condition afflicting clustermesh while stopping the retrieval of the remote cluster configuration, possibly causing a deadlock (Backport PR #33809, Upstream PR #33735, @giorio94)
+* Fixes a race condition during agent startup that causes the k8s node label updates to not get propagated to the host endpoint. (Backport PR #33663, Upstream PR #33511, @skmatti)
+* gateway-api: Add HTTP method condition in sortable routes (Backport PR #34157, Upstream PR #34109, @sayboras)
+* gateway-api: Enqueue gateway for Reference Grant changes (Backport PR #34157, Upstream PR #34032, @sayboras)
+* helm: remove duplicate metrics for Envoy pod (Backport PR #34157, Upstream PR #33803, @mhofstetter)
+* lbipam: fixed bug in sharing key logic (Backport PR #34157, Upstream PR #34106, @dylandreimerink)
+* pkg/metrics: fix data race warning on metrics init hook. (Backport PR #33962, Upstream PR #33823, @tommyp1ckles)
+* Reduce conntrack lifetime for closing service connections. (Backport PR #33962, Upstream PR #33907, @julianwiedmann)
+* Skip regenerating host endpoint on k8s node labels update if identity labels are unchanged (Backport PR #33809, Upstream PR #33306, @skmatti)
+* The cilium agent will now recover from stale nodeID mappings which could occur in clusters with high node churn, possibly manifesting itself in dropped IPsec traffic. (Backport PR #34157, Upstream PR #33666, @bimmlerd)
+
+**CI Changes:**
+* [v1.15] ci/ipsec: add missing config for patch-upgrade test with 6.6 kernel (cilium/cilium#33736, @julianwiedmann)
+* [v1.15] gh/e2e: fix up config 15 to not use bpf-next (cilium/cilium#33738, @julianwiedmann)
+* gha: Add http client timeout in Ingress (Backport PR #33809, Upstream PR #33683, @sayboras)
+* gha: don't fail if all cloud provider matrix entries are filtered out (Backport PR #33962, Upstream PR #33819, @giorio94)
+* gha: ensure that helm values.schema.json is not accidentally backported (cilium/cilium#33845, @giorio94)
+* gha: lint absence of trailing spaces in workflow files (Backport PR #34157, Upstream PR #33908, @giorio94)
+* gha: simplify the call-backport-label-updater workflow (Backport PR #33962, Upstream PR #33934, @giorio94)
+* test: use cgr.dev/chainguard/busybox:latest instead of docker.io image. (Backport PR #34157, Upstream PR #34004, @tommyp1ckles)
+* tests-clustermesh-upgrade: Don't hardcode test namespace (Backport PR #34157, Upstream PR #34121, @michi-covalent)
+* workflow: Use per-tunnel keys for the IPsec upgrade test (Backport PR #33809, Upstream PR #33769, @pchaigno)
+
+**Misc Changes:**
+* [v1.15] Update Docker dependency (cilium/cilium#34196, @ferozsalam)
+* bugtool: dumping more Envoy information (Backport PR #34157, Upstream PR #34110, @mhofstetter)
+* chore(deps): update all github action dependencies (v1.15) (cilium/cilium#34170, @cilium-renovate[bot])
+* chore(deps): update all-dependencies (v1.15) (cilium/cilium#33649, @cilium-renovate[bot])
+* chore(deps): update all-dependencies (v1.15) (cilium/cilium#34168, @cilium-renovate[bot])
+* chore(deps): update cilium/little-vm-helper action to v0.0.19 (v1.15) (cilium/cilium#33793, @cilium-renovate[bot])
+* chore(deps): update dependency cilium/cilium-cli to v0.16.13 (v1.15) (cilium/cilium#33794, @cilium-renovate[bot])
+* chore(deps): update dependency cilium/hubble to v1 (v1.15) (cilium/cilium#34051, @cilium-renovate[bot])
+* chore(deps): update docker.io/library/golang:1.21.12 docker digest to 7e0e13a (v1.15) (cilium/cilium#33792, @cilium-renovate[bot])
+* chore(deps): update go to v1.22.5 (v1.15) (cilium/cilium#33857, @cilium-renovate[bot])
+* chore(deps): update go to v1.22.6 (v1.15) (cilium/cilium#34167, @cilium-renovate[bot])
+* chore(deps): update stable lvh-images (v1.15) (patch) (cilium/cilium#33798, @cilium-renovate[bot])
+* daemon/ipam: don't swallow parse error of CIDR (Backport PR #33809, Upstream PR #33283, @bimmlerd)
+* doc: update slack channel reference (Backport PR #34157, Upstream PR #34044, @Huweicai)
+* docs,LRP: Add steps to restart agent and operator pods and update feature roadmap status (Backport PR #33809, Upstream PR #33655, @aditighag)
+* docs: Add node about socketLB.hostNamespaceOnly to Kata page (Backport PR #33809, Upstream PR #33725, @brb)
+* docs: Extend LRP guide with troubleshooting section (Backport PR #33809, Upstream PR #33373, @aditighag)
+* docs: generalize version specific notes section (Backport PR #33962, Upstream PR #33888, @giorio94)
+* docs: Remove CNCF graduation from the roadmap (Backport PR #33809, Upstream PR #33680, @joestringer)
+* docs: remove mention of outdated clustermesh + L7 policies + tunnel limitation (Backport PR #33809, Upstream PR #33626, @giorio94)
+* docs: Update LVH VM image pull instructions (Backport PR #33809, Upstream PR #33621, @brb)
+* Documentation: Add --set cni.exclusive=false for Azure Chain Mode (Backport PR #33809, Upstream PR #33708, @Mais316)
+* helm: Allow socket linger timeout to be set to zero (Backport PR #33962, Upstream PR #33887, @gandro)
+* policy: Fix `mapstate.Diff()` used in tests (Backport PR #33809, Upstream PR #33449, @jrajahalme)
+* Remove stable tags from v1.15 releases (cilium/cilium#33985, @joestringer)
+* renovate: onboard etcd image used in integration tests (Backport PR #33809, Upstream PR #33679, @giorio94)
+* Revert "fix: support validation of stringToString values in ConfigMap" (Backport PR #34306, Upstream PR #34277, @aanm)
+
+**Other Changes:**
+* [v1.15] ci: use base and head SHAs from context in lint-build-commits workflow (cilium/cilium#34267, @tklauser)
+* [v1.15] Revert "docs: Update LRP feature status" (cilium/cilium#34238, @ysksuzuki)
+* Fix bug in Bandwidth Manager that caused it to not find native devices. (cilium/cilium#33910, @joamaki)
+* install: Update image digests for v1.15.7 (cilium/cilium#33744, @cilium-release-bot[bot])
+
 ## v1.15.7
 
 Summary of Changes

Documentation/helm-values.rst

@@ -50,6 +50,8 @@
 +--------------------+----------------+
 | v1.13.17           | 1.26.8         |
 +--------------------+----------------+
+| v1.13.18           | 1.26.8         |
++--------------------+----------------+
 | v1.13              | 1.26.8         |
 +--------------------+----------------+
 | v1.14.0-pre.2      | 1.26.8         |
@@ -98,6 +100,8 @@
 +--------------------+----------------+
 | v1.14.12           | 1.27.1         |
 +--------------------+----------------+
+| v1.14.13           | 1.27.1         |
++--------------------+----------------+
 | v1.14              | 1.27.1         |
 +--------------------+----------------+
 | v1.15.0-pre.0      | 1.26.9         |
@@ -126,7 +130,9 @@
 +--------------------+----------------+
 | v1.15.6            | 1.28.2         |
 +--------------------+----------------+
+| v1.15.7            | 1.28.2         |
++--------------------+----------------+
 | v1.15              | 1.28.2         |
 +--------------------+----------------+
-| latest / main      | 1.30.0         |
+| latest / main      | 1.30.1         |
 +--------------------+----------------+

Documentation/network/kubernetes/compatibility-table.rst

@@ -1 +1 @@
-1.15.7
+1.15.8

VERSION

@@ -2,12 +2,12 @@
 # Copyright 2024 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-export CILIUM_DIGEST := "sha256:2e432bf6879feb8b891c497d6fd784b13e53456017d2b8e4ea734145f0282ef0"
-export CLUSTERMESH_APISERVER_DIGEST := "sha256:f8fc26060e0f0c131200b762667f91788a4499362fc72209ce30b4032e926c68"
-export DOCKER_PLUGIN_DIGEST := "sha256:1091cd5586fd5bac23816a05f8828758442a134255e0f73f0ac384310395d304"
-export HUBBLE_RELAY_DIGEST := "sha256:12870e87ec6c105ca86885c4ee7c184ece6b706cc0f22f63d2a62a9a818fd68f"
-export OPERATOR_ALIBABACLOUD_DIGEST := "sha256:2dcd7e3305cb47e4b5fbbb9bc2451d6aacb18788a87cab95cf86aec65ec19329"
-export OPERATOR_AWS_DIGEST := "sha256:bb4085da666a5c7a7c6f8135f0de10f0b6895dbf561e9fccda0e272b51bb936e"
-export OPERATOR_AZURE_DIGEST := "sha256:8e189549bc3c31a44a1171cc970b8e502ae8bf55cd07035735c4b3a24a16f80b"
-export OPERATOR_GENERIC_DIGEST := "sha256:6840a6dde703b3e73dd31e03390327a9184fcb888efbad9d9d098d65b9035b54"
-export OPERATOR_DIGEST := "sha256:9a599861adc64631c134f86c95823321b59948f35ebc5af31586987d74166341"
+export CILIUM_DIGEST := ""
+export CLUSTERMESH_APISERVER_DIGEST := ""
+export DOCKER_PLUGIN_DIGEST := ""
+export HUBBLE_RELAY_DIGEST := ""
+export OPERATOR_ALIBABACLOUD_DIGEST := ""
+export OPERATOR_AWS_DIGEST := ""
+export OPERATOR_AZURE_DIGEST := ""
+export OPERATOR_GENERIC_DIGEST := ""
+export OPERATOR_DIGEST := ""

install/kubernetes/Makefile.digests

@@ -2,8 +2,8 @@ apiVersion: v2
 name: cilium
 displayName: Cilium
 home: https://cilium.io/
-version: 1.15.7
-appVersion: 1.15.7
+version: 1.15.8
+appVersion: 1.15.8
 kubeVersion: ">= 1.16.0-0"
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.15/Documentation/images/logo-solo.svg
 description: eBPF-based Networking, Security, and Observability