Prepare for release v1.13.6

Signed-off-by: Maciej Kwiek <maciej@isovalent.com>

.github/maintainers-little-helper.yaml

@@ -1,4 +1,4 @@
-project: "https://github.com/cilium/cilium/projects/244"
+project: "https://github.com/cilium/cilium/projects/245"
 column: "In progress"
 auto-label:
   - "kind/backports"

AUTHORS

@@ -129,6 +129,7 @@ Daniel T. Lee                           danieltimlee@gmail.com
 Danni Skov Høglund                      skuffe@pwnz.dk
 Dan Sexton                              dan.b.sexton@gmail.com
 Dan Wendlandt                           dan@covalent.io
+Dario Mader                             maderdario@gmail.com
 darox                                   maderdario@gmail.com
 Darren Foo                              darren.foo@shopify.com
 Darren Mackintosh                       unixdaddy@gmail.com
@@ -451,6 +452,7 @@ Rémy Léone                              rleone@scaleway.com
 Renat Tuktarov                          yandzeek@gmail.com
 Rene Luria                              rene@luria.ch
 Rene Zbinden                            rene.zbinden@postfinance.ch
+Ricky Ho                                horicky78@gmail.com
 Rio Kierkels                            riokierkels@gmail.com
 Robin Gögge                             r.goegge@isovalent.com
 Robin Hahling                           robin.hahling@gw-computing.net
@@ -549,6 +551,7 @@ Viktor Oreshkin                         imselfish@stek29.rocks
 Ville Ojamo                             bluikko@users.noreply.github.com
 Vincent Li                              v.li@f5.com
 vipul-21                                vipul21sept@gmail.com
+Vipul Singh                             singhvipul@microsoft.com
 Vishal Choudhary                        contactvishaltech@gmail.com
 Vishnu Soman K                          vishnusomank05@gmail.com
 Vlad Artamonov                          742047+vladdy@users.noreply.github.com

CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## v1.13.6
+
+Summary of Changes
+------------------
+
+**Minor Changes:**
+* Prevent Cilium from running with Delegated IPAM at the same time as Ingress (Backport PR #27239, Upstream PR #26744, @rickysumho)
+* Update Service Mesh docs to fix a number of issues (#27333, @youngnick)
+
+**Bugfixes:**
+* Fix a bug that affected the health-check feature in Stand-alone L4LB mode. For certain configurations (eg if both IPv4 and IPv6 support is enabled) health-check traffic would not get IPIP-encapsulated. (Backport PR #27154, Upstream PR #27015, @julianwiedmann)
+* Fix a bug that could cause packet drops of type XfrmOutPolBlock when IPsec is enabled and node are recycled. Fix a bug that could cause IPsec-encrypted packets to be sent to the wrong destination node when node churn is high. (Backport PR #27107, Upstream PR #27029, @pchaigno)
+* operator: Adjust CiliumEndpoint gc to account for kvstore mode (Backport PR #27154, Upstream PR #25324, @learnitall)
+
+**CI Changes:**
+* Add BPF unit tests for IPsec (Backport PR #27107, Upstream PR #25699, @jschwinger233)
+* Add renovate tags for automatic updates of kernel version in v1.13 (#27387, @aanm)
+* Fix verifier issues in IPv6 BPF tests (Backport PR #27107, Upstream PR #25191, @dylandreimerink)
+* Trigger required workflows using Ariane (Backport PR #27095, Upstream PR #27002, @michi-covalent)
+
+**Misc Changes:**
+* Add note for changing IPAM settings (Backport PR #27239, Upstream PR #27090, @darox)
+* bpf: test: Fix the byte order in the IPV4 macro (Backport PR #27107, Upstream PR #25114, @gentoo-root)
+* chore(deps): update all github action dependencies (v1.13) (patch) (#27290, @renovate[bot])
+* chore(deps): update docker.io/library/golang docker tag to v1.19.12 (v1.13) (#26825, @renovate[bot])
+* chore(deps): update docker/setup-buildx-action action to v2.9.1 (v1.13) (#26827, @renovate[bot])
+* chore(deps): update helm/kind-action action to v1.8.0 (v1.13) (#26828, @renovate[bot])
+* docs: Fix gRPC API generation for online docs (Backport PR #27095, Upstream PR #27014, @qmonnet)
+* docs: fixed search for every page (Backport PR #26906, Upstream PR #26892, @geakstr)
+* docs: Ignore Helm values, update spelling list (Backport PR #26906, Upstream PR #26759, @qmonnet)
+* docs: Replace non-portable "sed -i" in Makefile (Backport PR #27239, Upstream PR #27122, @qmonnet)
+* docs: Revert Python version in docs-builder image to 3.7.9, downgrade sphinxcontrib-applehelp, to fix builds on Read The Docs (Backport PR #26906, Upstream PR #24099, @qmonnet)
+* docs: Simplify clustermesh example (Backport PR #27239, Upstream PR #27172, @joestringer)
+* docs: Update dependencies for documentation build system (Sphinx, add-ons etc.) (Backport PR #26906, Upstream PR #24014, @qmonnet)
+* Documentation: enable parallel builds (Backport PR #26906, Upstream PR #23752, @squeed)
+* Documentation: fix the broken links/dead links (Backport PR #27154, Upstream PR #26880, @vipul-21)
+* endpoint: don't hold the endpoint lock while generating policy (Backport PR #26735, Upstream PR #26242, @squeed)
+
+**Other Changes:**
+* backport v1.13: IPsec upgrade tests (#27174, @brb)
+* install: Update image digests for v1.13.5 (#27120, @nathanjsweet)
+* k8s: fix incorrect EndpointSlice API version (#27277, @ysksuzuki)
+* remove stable tag from image build (#27076, @aanm)
+* v1.13 backport:  gh/workflows: Reusable workflow for ci-e2e and misc changes (#27374, @brb)
+
 ## v1.13.5
 
 Summary of Changes

Documentation/network/kubernetes/compatibility-table.rst

@@ -48,6 +48,8 @@
 +-----------------+----------------+
 | v1.11.18        | 1.24.4         |
 +-----------------+----------------+
+| v1.11.19        | 1.24.4         |
++-----------------+----------------+
 | v1.11           | 1.24.4         |
 +-----------------+----------------+
 | v1.12.0-rc0     | 1.25.1         |
@@ -82,6 +84,8 @@
 +-----------------+----------------+
 | v1.12.11        | 1.25.7         |
 +-----------------+----------------+
+| v1.12.12        | 1.25.7         |
++-----------------+----------------+
 | v1.12           | 1.25.7         |
 +-----------------+----------------+
 | v1.13.0-rc0     | 1.26.0         |
@@ -106,7 +110,9 @@
 +-----------------+----------------+
 | v1.13.4         | 1.26.7         |
 +-----------------+----------------+
+| v1.13.5         | 1.26.7         |
++-----------------+----------------+
 | v1.13           | 1.26.7         |
 +-----------------+----------------+
-| latest / master | 1.26.9         |
+| latest / master | 1.26.7         |
 +-----------------+----------------+

VERSION

@@ -1 +1 @@
-1.13.5
+1.13.6

install/kubernetes/Makefile.digests

@@ -2,12 +2,12 @@
 # Copyright 2023 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-export CILIUM_DIGEST := "sha256:e02744b4413824093d25a6fb35e2e418f7301e55825fa53a8e1943fe7e9e5aef"
-export CLUSTERMESH_APISERVER_DIGEST := "sha256:466182b742140f1566926d28066943206a62e80114460b8a46de029395b82e47"
-export DOCKER_PLUGIN_DIGEST := "sha256:8803098ca8710f6c48189e8918a77d81c20657494c7af3da154c1ca66759df25"
-export HUBBLE_RELAY_DIGEST := "sha256:a1bca42ac2f9f934d7dc9311ecff5ff7012023830a63ba2980091abbfc148cbb"
-export OPERATOR_ALIBABACLOUD_DIGEST := "sha256:acbcabaa7a7baa9a696f8ffffc428ee262c87fc36bc792099ac1bed6a7bfe993"
-export OPERATOR_AWS_DIGEST := "sha256:e2b93136fe0a3f3d3914a24c76f78011c9a626e5510f50afd5fc24e48793ea20"
-export OPERATOR_AZURE_DIGEST := "sha256:561be7360082515f22d6e34f073c2299e6889567a0578cd0ce51d68e0b0dcb81"
-export OPERATOR_GENERIC_DIGEST := "sha256:d77f3e1472725b3c28b5d88d6a49c7fcba3072c0c08a26e2e16c1e9139c96207"
-export OPERATOR_DIGEST := "sha256:7d2128278d33bd191c1cdc5968456fe702d8b7f9c81e63689f7a1510091dd54d"
+export CILIUM_DIGEST := ""
+export CLUSTERMESH_APISERVER_DIGEST := ""
+export DOCKER_PLUGIN_DIGEST := ""
+export HUBBLE_RELAY_DIGEST := ""
+export OPERATOR_ALIBABACLOUD_DIGEST := ""
+export OPERATOR_AWS_DIGEST := ""
+export OPERATOR_AZURE_DIGEST := ""
+export OPERATOR_GENERIC_DIGEST := ""
+export OPERATOR_DIGEST := ""

install/kubernetes/cilium/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: cilium
 displayName: Cilium
 home: https://cilium.io/
-version: 1.13.5
-appVersion: 1.13.5
+version: 1.13.6
+appVersion: 1.13.6
 kubeVersion: ">= 1.16.0-0"
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.13/Documentation/images/logo-solo.svg
 description: eBPF-based Networking, Security, and Observability

install/kubernetes/cilium/README.md

@@ -1,6 +1,6 @@
 # cilium
 
-![Version: 1.13.5](https://img.shields.io/badge/Version-1.13.5-informational?style=flat-square) ![AppVersion: 1.13.5](https://img.shields.io/badge/AppVersion-1.13.5-informational?style=flat-square)
+![Version: 1.13.6](https://img.shields.io/badge/Version-1.13.6-informational?style=flat-square) ![AppVersion: 1.13.6](https://img.shields.io/badge/AppVersion-1.13.6-informational?style=flat-square)
 
 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -111,7 +111,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraEnv | list | `[]` | Additional clustermesh-apiserver environment variables. |
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:466182b742140f1566926d28066943206a62e80114460b8a46de029395b82e47","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.13.5","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.13.6","useDigest":false}` | Clustermesh API server image. |
 | clustermesh.apiserver.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | clustermesh.apiserver.podAnnotations | object | `{}` | Annotations to be added to clustermesh-apiserver pods |
 | clustermesh.apiserver.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -289,7 +289,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.dialTimeout | string | `nil` | Dial timeout to connect to the local hubble instance to receive peer information (e.g. "30s"). |
 | hubble.relay.enabled | bool | `false` | Enable Hubble Relay (requires hubble.enabled=true) |
 | hubble.relay.extraEnv | list | `[]` | Additional hubble-relay environment variables. |
-| hubble.relay.image | object | `{"digest":"sha256:a1bca42ac2f9f934d7dc9311ecff5ff7012023830a63ba2980091abbfc148cbb","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.13.5","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.13.6","useDigest":false}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -384,7 +384,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
-| image | object | `{"digest":"sha256:e02744b4413824093d25a6fb35e2e418f7301e55825fa53a8e1943fe7e9e5aef","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.5","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.6","useDigest":false}` | Agent container image. |
 | imagePullSecrets | string | `nil` | Configure image pull secrets for pulling container images |
 | ingressController.enabled | bool | `false` | Enable cilium ingress controller This will automatically set enable-envoy-config as well. |
 | ingressController.enforceHttps | bool | `true` | Enforce https for host having matching TLS host in Ingress. Incoming traffic to http listener will return 308 http error code with respective location in header. |
@@ -474,7 +474,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.extraVolumes | list | `[]` | Additional cilium-operator volumes. |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:acbcabaa7a7baa9a696f8ffffc428ee262c87fc36bc792099ac1bed6a7bfe993","awsDigest":"sha256:e2b93136fe0a3f3d3914a24c76f78011c9a626e5510f50afd5fc24e48793ea20","azureDigest":"sha256:561be7360082515f22d6e34f073c2299e6889567a0578cd0ce51d68e0b0dcb81","genericDigest":"sha256:d77f3e1472725b3c28b5d88d6a49c7fcba3072c0c08a26e2e16c1e9139c96207","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.13.5","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"","awsDigest":"","azureDigest":"","genericDigest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.13.6","useDigest":false}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -520,7 +520,7 @@ contributors across the globe, there is almost always someone available to help.
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:e02744b4413824093d25a6fb35e2e418f7301e55825fa53a8e1943fe7e9e5aef","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.5","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.13.6","useDigest":false}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |