Merge tag 'v1.19.6' into v1.19-dd

Release v1.19.6

Author: HadrienPatte

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "Cilium",
-  "image": "quay.io/cilium/cilium-builder:6575744abb6036cc127c1b4d5845c5c03277c44a@sha256:1e623ddfc58fc4e4012861b3b854b02ecfea073011fe05a2d05deccc6474d144",
+  "image": "quay.io/cilium/cilium-builder:f22cbf4d510e3e403b6cc3e4670f5b157385ea2c@sha256:a7054a6dfac28873123b9047f025c21455dbcec681b4a02674703cbbdd73e0df",
   "workspaceFolder": "/go/src/github.com/cilium/cilium",
   "workspaceMount": "source=${localWorkspaceFolder},target=/go/src/github.com/cilium/cilium,type=bind",
   "features": {

.github/actions/kind-external-network/action.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 LVH="$1"
 
 lvh_wrapper() {

.github/actions/kind-external-targets/action.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 LVH="$1"
 KINDNETWORK="$2"
 IP4TARGET="$3"
@@ -15,6 +17,20 @@ lvh_wrapper() {
 	fi
 }
 
+# Run the given command, retrying up to 5 times on failure.
+retry() {
+	local attempt
+	for attempt in $(seq 1 5); do
+		if "$@"; then
+			return 0
+		fi
+		echo "Attempt ${attempt}/5 of '$*' failed, retrying in 5s..." >&2
+		sleep 5
+	done
+	echo "::error::Command '$*' failed after 5 attempts" >&2
+	return 1
+}
+
 TARGETNAME=fake.external.service.cilium
 OTHERTARGETNAME=fake.external.service.other.cilium
 
@@ -113,20 +129,29 @@ http {
 EOF
 
 # Start our first external target
-CONTAINERID=$(lvh_wrapper docker run -d --name webserver --network $KINDNETWORK \
+retry lvh_wrapper docker run -d --name webserver --network $KINDNETWORK \
     --ip $IP4TARGET --ip6 $IP6TARGET \
     -v ./nginx.conf:/etc/nginx/nginx.conf:ro \
     -v ./external-service.cilium.crt:/etc/ssl/external-service.cilium.crt:ro \
     -v ./external-service.cilium.key:/etc/ssl/external-service.cilium.key:ro \
-    nginx)
+    nginx
 
 # Start the second external target
-CONTAINERID=$(lvh_wrapper docker run -d --name other-webserver --network $KINDNETWORK \
+retry lvh_wrapper docker run -d --name other-webserver --network $KINDNETWORK \
     --ip $IP4OTHERTARGET --ip6 $IP6OTHERTARGET \
     -v ./nginx.conf:/etc/nginx/nginx.conf:ro \
     -v ./external-service.cilium.crt:/etc/ssl/external-service.cilium.crt:ro \
     -v ./external-service.cilium.key:/etc/ssl/external-service.cilium.key:ro \
-    nginx)
+    nginx
+
+# Fail fast if either target did not actually come up.
+for container in webserver other-webserver; do
+	running=$(lvh_wrapper docker inspect -f '{{.State.Running}}' "$container")
+	if [ "$running" != "true" ]; then
+		echo "::error::External target container '$container' is not running (State.Running=$running)" >&2
+		exit 1
+	fi
+done
 
 # Get the current CoreDNS config file
 kubectl -n kube-system get configmap/coredns -o json | jq ".data.Corefile" -r  > Corefile

.github/actions/renovate/entrypoint.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 apt update
 
 apt install -y gettext docker-buildx
@@ -12,7 +14,8 @@ ls -lah /var/run/docker.sock
 
 # Add the group of /var/run/docker.sock to ubuntu user
 GROUP_ID=$(stat -c '%g' /var/run/docker.sock)
-GROUP_NAME=$(getent group "$GROUP_ID" | cut -d: -f1)
+# getent exits non-zero when no group matches the id, which is expected here.
+GROUP_NAME=$(getent group "$GROUP_ID" | cut -d: -f1 || true)
 
 if [ -z "$GROUP_NAME" ]; then
   GROUP_NAME="docker_group"

.github/actions/set-env-variables/action.yml

@@ -19,7 +19,7 @@ runs:
         echo "BGP_CONTROL_PLANE_HELM_VALUES=--helm-set=bgpControlPlane.enabled=true" >> $GITHUB_ENV
         echo "CILIUM_CLI_RELEASE_REPO=cilium/cilium-cli" >> $GITHUB_ENV
         # renovate: datasource=github-releases depName=cilium/cilium-cli
-        CILIUM_CLI_VERSION="v0.19.4"
+        CILIUM_CLI_VERSION="v0.19.5"
         echo "CILIUM_CLI_VERSION=$CILIUM_CLI_VERSION" >> $GITHUB_ENV
         echo "CILIUM_CLI_IMAGE_REPO=$REGISTRY_DEV/cilium/cilium-cli-ci" >> $GITHUB_ENV
         echo "CILIUM_CLI_SKIP_BUILD=true" >> $GITHUB_ENV

.github/actions/set-runtime-image/runtime-image.txt

@@ -1 +1 @@
-quay.io/cilium/cilium-runtime:0c9885c9481c1b88b60712849cd6c399a1facfb2@sha256:af5796c16b6eff60f98729cd3fa27750615e1caf8904d29a9b81f6a8231eceb8
+quay.io/cilium/cilium-runtime:2b0b19b6469911dedd1cf0b69d15eb9db6245914@sha256:2414e2fc8ee3f2d5eaf8a84f895a49b8adea4b34735339ce5f6224486e2f069e

.github/ariane-config.yaml

@@ -4,23 +4,15 @@ allowed-teams:
 triggers:
   /default:
     workflows:
-    - cilium-cli.yaml
     - conformance-kind-proxy-embedded.yaml
-    - codeql.yaml
-    - lint-go.yaml
-    - tests-smoke.yaml
     - tests-smoke-conformance.yaml
     - tests-smoke-ipv6.yaml
     - tests-cifuzz.yaml
     - lint-ariane-config.yaml
     - conformance-kubespray.yaml
-    - lint-build-commits.yaml
-    - documentation.yaml
     - k8s-kind-network-e2e.yaml
     - lint-images-base.yaml
-    - lint-workflows.yaml
     - k8s-kind-network-policies-e2e.yaml
-    - lint-bpf-checks.yaml
   # This trigger needs to be kept in sync with ariane-scheduled.yaml workflow
   /test\s*:
     workflows:
@@ -201,4 +193,10 @@ workflows:
   tests-cifuzz.yaml:
     paths-regex: (\.github/workflows/tests-cifuzz\.yaml|fuzz_test.go|test/fuzzing/)
   k8s-kind-network-policies-e2e.yaml:
-    paths-ignore-regex: (Documentation/|test/)
+    paths-ignore-regex: (Documentation/|test/)
+  tests-smoke-conformance.yaml:
+    paths-ignore-regex: ((bpf/complexity-tests|bpf/tests|test|Documentation|hubble|.github/actions/cl2-modules|.github/actions/e2e|.github/actions/ginkgo)/|(.github/renovate\.json5|README.rst|CODEOWNERS|stable.txt|.*\.md|.*_test\.go)$)
+  k8s-kind-network-e2e.yaml:
+    paths-ignore-regex: ((bpf/complexity-tests|bpf/tests|test|Documentation|hubble|.github/actions/cl2-modules|.github/actions/e2e|.github/actions/ginkgo)/|(.github/renovate\.json5|README.rst|CODEOWNERS|stable.txt|.*\.md|.*_test\.go)$)
+  tests-smoke-ipv6.yaml:
+    paths-ignore-regex: ((bpf/complexity-tests|bpf/tests|test|Documentation|hubble|.github/actions/cl2-modules|.github/actions/e2e|.github/actions/ginkgo)/|(.github/renovate\.json5|README.rst|CODEOWNERS|stable.txt|.*\.md|.*_test\.go)$)

.github/workflows/auto-approve.yaml

@@ -26,7 +26,9 @@ jobs:
   approve:
     name: Approve
     needs: pre-approve
-    environment: auto-approve
+    environment:
+      name: auto-approve
+      deployment: false
     runs-on: ubuntu-24.04
     permissions: {}
     steps:

.github/workflows/build-go-caches.yaml

@@ -64,7 +64,7 @@ jobs:
           comment_on_pr: false
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -75,7 +75,7 @@ jobs:
 
       # Load Golang cache build from GitHub
       - name: Load Golang cache build from GitHub
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: go-cache
         with:
           path: /tmp/.cache/go

.github/workflows/build-images-base-v1.19.yaml

@@ -36,11 +36,13 @@ jobs:
     if: ${{ vars.QUAY_BASE_RELEASE_ENABLED == 'true' && ! (github.event_name == 'pull_request_target' && startsWith(github.head_ref, 'renovate/')) }}
     name: Build and Push Images
     timeout-minutes: 60
-    environment: 'release-base-images'
+    environment:
+      name: ${{ inputs.environment || 'release-base-images' }}
+      deployment: false
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout base or default branch (trusted)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # This workflow is supposed to run only on pull_request_target context, but in case workflow call is made from a push context we still keep the default to default_branch
           ref: ${{ github.base_ref || github.event.repository.default_branch }}
@@ -68,19 +70,21 @@ jobs:
         uses: ./.github/actions/set-env-variables
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Set up QEMU
         id: qemu
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       # Warning: since this is a privileged workflow, subsequent workflow job
       # steps must take care not to execute untrusted code.
       - name: Checkout pull request branch (NOT TRUSTED)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
+          # Required by checkout v7+ to fetch fork PR code; see the NOT TRUSTED warning above.
+          allow-unsafe-pr-checkout: true
 
       - name: Set-up git
         run: |
@@ -104,15 +108,15 @@ jobs:
 
       - name: Login to ${{ env.REGISTRY_DEV }}
         if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY_DEV }}
           username: ${{ secrets.QUAY_BASE_RELEASE_USERNAME_202411 }}
           password: ${{ secrets.QUAY_BASE_RELEASE_PASSWORD_202411 }}
 
       - name: Release build cilium-runtime
         if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: docker_build_release_runtime
         with:
           provenance: false
@@ -182,15 +186,15 @@ jobs:
 
       - name: Login to ${{ env.REGISTRY_DEV }}
         if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' && steps.cilium-runtime-tag-in-repositories.outputs.exists != 'false' }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY_DEV }}
           username: ${{ secrets.QUAY_BASE_RELEASE_USERNAME_202411 }}
           password: ${{ secrets.QUAY_BASE_RELEASE_PASSWORD_202411 }}
 
       - name: Release build cilium-builder
         if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: docker_build_release_builder
         with:
           provenance: false