Prepare for release v1.15.5

[nebril]

Summary of Changes

Minor Changes:

• envoy: Bump go version to 1.22.3 (envoy: Bump go version to 1.22.3 #32413, @sayboras)
• labels: Add controller-uid into default ignore list (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR labels: Add controller-uid into default ignore list #31964, @sayboras)

Bugfixes:

• Agent: add kubeconfigPath to initContainers (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR Agent: add kubeconfigPath to initContainers #32008, @darox)
• Avoids drops with "No mapping for NAT masquerade" for ICMP messages by local service backends. (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR bpf: lxc: don't take RevDNAT tailcall for service backend's ICMP messages #32155, @julianwiedmann)
• cilium-cni: Reserve ports that can conflict with transparent DNS proxy (Backport PR [v1.15] cilium-cni: Reserve ports that can conflict with transparent DNS proxy #32418, Upstream PR cilium-cni: Reserve ports that can conflict with transparent DNS proxy #32128, @gandro)
• cni: Use correct route MTU when ENI, Azure or Alibaba Cloud IPAM is enabled (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR cni: Use correct route MTU for various cloud cidrs #32244, @learnitall)
• dnsproxy: Fix bug where DNS request timed out too soon (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR dnsproxy: Fix bug where DNS request timed out too soon #31999, @gandro)
• Envoy upstream connections are now unique for each downstream connection when using the original source address of a source pod. (Backport PR [v1.15] Envoy use port in conn pool #32312, Upstream PR envoy: Update to use source port in connection pool hash #32270, @jrajahalme)
• envoy: pass idle timeout configuration option to cilium configmap (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR envoy: pass idle timeout configuration option to cilium configmap #32203, @mhofstetter)
• Fix failing service connections, when the service requests are transported via cilium's overlay network. (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR bpf: nodeport: fix double-SNAT for LB'ed requests in from-overlay #32116, @julianwiedmann)
• Fix issue causing clustermesh-apiserver/kvstoremesh to not start when run with a non-root user (Backport PR v1.15 Backports 2024-04-10 #31879, Upstream PR Fix issue causing clustermesh-apiserver/kvstoremesh to not start when run with a non-root user #31539, @giorio94)
• Fix service connection to terminating backend, when the service has no more backends available. (Backport PR [v1.15] bpf: lb: un-break terminating backends for service without backend #32092, Upstream PR bpf: lb: un-break terminating backends for service without backend #31840, @julianwiedmann)
• Fix various bugs related to restart of StatefulSet pods that may result in connectivity issues (Backport PR v1.15 backports 2024-05-08 #32432, Upstream PR Fix various bugs related to restart of StatefulSet pods that may result in connectivity issues #31605, @christarazi)
• Fixes a bug where Cilium in chained mode removed the agent-not-ready taint too early if the primary network is slow in deploying. (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR daemon: don't go ready until CNI configuration has been written #32168, @squeed)
• Fixes an (unlikely) bug where HostFirewall policies may miss updates to a node's labels. (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR pkg: don't cache Host identity rule matches #30548, @squeed)
• fqdn: fix memory leak in transparent mode when there was a moderately high number of parallel DNS requests (>100). (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR fqdn: Fix goroutine leak in transparent-mode #31959, @marseel)
• Ingress/Gateway API: merge Envoy listeners for HTTP(S) and TLS passthrough (Backport PR [v1.15] Author backport of #31646 #32178, Upstream PR Ingress/Gateway API: merge Envoy listeners for HTTP(S) and TLS passthrough #31646, @mhofstetter)
• ipam: retry netlink.LinkList call when setting up ENI devices (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR ipam: retry netlink.LinkList call when setting up ENI devices #32099, @jasonaliyetti)
• loader: sanitize bpffs directory strings for netdevs (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR loader: sanitize bpffs directory strings for netdevs #32090, @rgo3)
• Prevent Cilium agents from incorrectly restarting an etcd watch against a different etcd instance. ([v1.15] Prevent Cilium agents from incorrectly restarting an etcd watch against a different clustermesh-apiserver instance. #32005, @giorio94)
• tables: Sort node addresses also by public vs private IP (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR tables: Sort node addresses also by public vs private IP #30579, @joamaki)

CI Changes:

• alibabacloud/eni: avoid racing node mgr in test (Backport PR v1.15 Backports 2024-04-15 #31967, Upstream PR alibabacloud/eni: avoid racing node mgr in test #31877, @bimmlerd)
• ci: Filter supported versions of AKS (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR ci: Filter supported versions of AKS #32303, @marseel)
• ci: Increase timeout for images for l4lb test (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR ci: Increase timeout for images for l4lb test #32201, @marseel)
• ci: Set hubble.relay.retryTimeout=5s (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR ci: Set hubble.relay.retryTimeout=5s  #32066, @chancez)
• enable kube cache mutation detector (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR enable kube cache mutation detector #32069, @aanm)
• gha: bump post-upgrade timeout in clustermesh upgrade/downgrade tests (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR gha: bump post-upgrade timeout in clustermesh upgrade/downgrade tests #32347, @giorio94)
• gha: configure fully-qualified DNS names as external targets (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR gha: configure fully-qualified DNS names as external targets #31510, @giorio94)
• gha: drop double installation of Cilium CLI in conformance-eks (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR gha: drop double installation of Cilium CLI in conformance-eks #32042, @giorio94)
• Miscellaneous improvements to the clustermesh upgrade/downgrade test (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR Miscellaneous improvements to the clustermesh upgrade/downgrade test #31958, @giorio94)
• route: dedicated net ns for each subtest of runListRules (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR route: dedicated net ns for each subtest of runListRules #29916, @mhofstetter)
• test: De-flake xds server_e2e_test (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR test: De-flake xds server_e2e_test #32004, @jrajahalme)
• workflows: Fix CI jobs for push events on private forks (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR workflows: Fix CI jobs for push events on private forks #32085, @pchaigno)

Misc Changes:

• bpf: host: simplify MARK_MAGIC_PROXY_EGRESS_EPID handling (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR bpf: host: simplify MARK_MAGIC_PROXY_EGRESS_EPID handling #29803, @julianwiedmann)
• build(deps): bump pydantic from 2.3.0 to 2.4.0 in /Documentation (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR build(deps): bump pydantic from 2.3.0 to 2.4.0 in /Documentation #32176, @dependabot[bot])
• chore(deps): update all github action dependencies (v1.15) (chore(deps): update all github action dependencies (v1.15) #31954, @renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (chore(deps): update all github action dependencies (v1.15) #32107, @renovate[bot])
• chore(deps): update all github action dependencies (v1.15) (chore(deps): update all github action dependencies (v1.15) #32366, @renovate[bot])
• chore(deps): update all-dependencies (v1.15) (chore(deps): update all-dependencies (v1.15) #31993, @renovate[bot])
• chore(deps): update all-dependencies (v1.15) (chore(deps): update all-dependencies (v1.15) #32238, @renovate[bot])
• chore(deps): update azure/login action to v2.1.0 (v1.15) (chore(deps): update azure/login action to v2.1.0 (v1.15) #31994, @renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.6 (v1.15) (chore(deps): update dependency cilium/cilium-cli to v0.16.6 (v1.15) #32365, @renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.9 docker digest to 81811f8 (v1.15) (chore(deps): update docker.io/library/golang:1.21.9 docker digest to 81811f8 (v1.15) #31953, @renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.9 docker digest to d83472f (v1.15) (chore(deps): update docker.io/library/golang:1.21.9 docker digest to d83472f (v1.15) #32257, @renovate[bot])
• chore(deps): update docker.io/library/ubuntu:22.04 docker digest to a6d2b38 (v1.15) (chore(deps): update docker.io/library/ubuntu:22.04 docker digest to a6d2b38 (v1.15) #32364, @renovate[bot])
• chore(deps): update go to v1.21.10 (v1.15) (chore(deps): update go to v1.21.10 (v1.15) #32417, @renovate[bot])
• chore(deps): update golangci/golangci-lint-action action to v6 (v1.15) (chore(deps): update golangci/golangci-lint-action action to v6 (v1.15) #32396, @renovate[bot])
• chore(deps): update hubble cli to v0.13.3 (v1.15) (chore(deps): update hubble cli to v0.13.3 (v1.15) #32108, @renovate[bot])
• chore(deps): update stable lvh-images (v1.15) (patch) (chore(deps): update stable lvh-images (v1.15) (patch) #31821, @renovate[bot])
• CI: bump default FQDN datapath timeout from 100 to 250ms (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR CI: bump default FQDN datapath timeout from 100 to 250ms #31866, @squeed)
• clustermesh: fix panic if the etcd client cannot be created (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR clustermesh: fix panic if the etcd client cannot be created #32225, @giorio94)
• docs: Add annotation for Ingress endpoint (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR docs: Add annotation for Ingress endpoint #32284, @sayboras)
• docs: add link to sig-policy meeting (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR docs: add link to sig-policy meeting #32340, @squeed)
• docs: Clean-up Host Firewall documentation, list known issues (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR docs: Clean-up Host Firewall documentation, list known issues #32267, @qmonnet)
• docs: Fix prometheus port regex (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR docs: Fix prometheus port regex #32030, @JBodkin-Amphora)
• Docs: mark Tetragon as Stable (Backport PR v1.15 Backports 2024-04-15 #31967, Upstream PR Docs: mark Tetragon as Stable #31886, @sharlns)
• Document Cluster Mesh global services limitations when KPR=false (Backport PR v1.15 Backports 2024-04-15 #31967, Upstream PR clustermesh: document global services limitations with KPR=false #31798, @giorio94)
• endpoint: Skip build queue warning log is context is canceled (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR endpoint: Skip build queue warning log is context is canceled #32132, @jrajahalme)
• Fix helm chart incompatible types for comparison (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR Fix helm chart incompatible types for comparison #32025, @lou-lan)
• fqdn: Change error log to warning (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR fqdn: Change error log to warning #32333, @jrajahalme)
• fqdn: Fix Upgrade Issue Between PortProto Versions (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR fqdn: Fix Upgrade Issue Between PortProto Versions #32325, @nathanjsweet)
• golangci: Enable errorlint (Backport PR [v1.15] golangci: Enable errorlint #31783, Upstream PR golangci: Enable errorlint #31458, @jrajahalme)
• images: Update bpftool, checkpatch images (Backport PR [v1.15] images: Update bpftool, checkpatch images #31896, Upstream PR images: Update bpftool, checkpatch images #31753, @qmonnet)
• Improve release organization page (Backport PR v1.15 Backports 2024-04-22 #32103, Upstream PR Improve release organization page #31970, @joestringer)
• install/kubernetes: add AppArmor profile to Cilium Daemonset (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR install/kubernetes: add AppArmor profile to Cilium Daemonset #32199, @aanm)
• install/kubernetes: update nodeinit image to latest version (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR install/kubernetes: update nodeinit image to latest version #32181, @tklauser)
• ipsec: Debug info for transient IPsec upgrade drops (Backport PR v1.15 Backports 2024-05-06 #32384, Upstream PR ipsec: Debug info for transient IPsec upgrade drops #32240, @pchaigno)
• l7 policy: add possibility to configure Envoy proxy xff-num-trusted-hops (Backport PR [v1.15] Author backport of #32200 #32260, Upstream PR l7 policy: add possibility to configure Envoy proxy xff-num-trusted-hops #32200, @mhofstetter)
• Remove aks-preview from AKS workflows (Backport PR v1.15 Backports 2024-04-29 #32230, Upstream PR Remove aks-preview from AKS workflows #32118, @marseel)
• Seamlessly downgrade bpf attachments from tcx to tc (Backport PR [v1.15] loader: implement seamless tcx to legacy tc downgrade #32337, Upstream PR loader: implement seamless tcx to legacy tc downgrade #32228, @ti-mo)

Other Changes:

• [1.15] images: update cilium-{runtime,builder} ([1.15] images: update cilium-{runtime,builder} #32444, @nebril)
• [v1.15-backport] Introduce fromEgressProxyRule ([v1.15-backport] Introduce fromEgressProxyRule #31922, @jschwinger233)
• [v1.15] cilium-dbg: remove section with unknown health status. ([v1.15] cilium-dbg: remove section with unknown health status. #31905, @tommyp1ckles)
• [v1.15] proxy: skip rule removal if address family is not supported ([v1.15] proxy: skip rule removal if address family is not supported #32007, @rgo3)
• envoy: Bump envoy version to v1.27.5 (envoy: Bump envoy version to v1.27.5 #32077, @sayboras)
• envoy: Update envoy 1.27.x to 1.28.3 (envoy: Update envoy 1.27.x to 1.28.3 #32149, @sayboras)
• fix k8s versions tested in CI (fix k8s versions tested in CI #31965, @nbusseneau)
• install: Update image digests for v1.15.4 (install: Update image digests for v1.15.4 #31915, @asauber)