Summary of Changes

Bugfixes:

• envoy: Avoid short circuit backend filtering (Backport PR v1.13 Backports 2024-07-03 #33535, Upstream PR envoy: Avoid short circuit backend filtering #33403, @sayboras)
• Fix service connection to terminating backend, when the service has no more backends available. (Backport PR [v1.13] bpf: lb: un-break terminating backends for service without backend #33276, Upstream PR bpf: lb: un-break terminating backends for service without backend #31840, @julianwiedmann)
• Fixes unencrypted traffic among nodes when IPsec is used with L7 egress proxy. (Backport PR [1.13-backport] ipsec: Fix unencrypted traffic when IPsec is used with L7 egress proxy #31977, Upstream PR ipsec: Fix unencrypted traffic when IPsec is used with L7 egress proxy #32683, @jschwinger233)
• ipsec: do not nil out EncryptInterface when using IPAM ENI on netlink… (Backport PR v1.13 Backports 2024-07-08 #33633, Upstream PR ipsec: do not nil out EncryptInterface when using IPAM ENI on netlink… #33512, @jasonaliyetti)
• Report the correct drop reason when a packet is dropped by the bpf_lxc program. (Backport PR v1.13 Backports 2024-07-08 #33633, Upstream PR bpf: lxc: fix up reporting of drop reason in drop_for_direction() #33551, @julianwiedmann)
• Revert PR cni: Use correct route MTU for various cloud cidrs #32244 which caused unintended side-effects that negatively impacted network performance. (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR cni: Revert "cni: Use correct route MTU for various cloud cidrs" #33304, @learnitall)
• Update IPsec to handle larger PSK values when using per-tunnel PSK (Backport PR v1.13 Backports 2024-07-02 #33532, Upstream PR Update IPsec to handle larger PSK values when using per-tunnel PSK #33472, @jasonaliyetti)

CI Changes:

• ci: Add IPsec leak detection for ci-ipsec-e2e (Backport PR [1.13] ci: Add IPsec leak detection for ci-ipsec-e2e #33080, Upstream PR ci: Add IPsec leak detection for ci-ipsec-e2e #32930, @jschwinger233)
• ci: use env variable to store branch name (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR ci: use env variable to store branch name #26779, @ferozsalam)
• gh: ipsec: clarify check for leaked proxy traffic during key rotation (Backport PR v1.13 Backports 2024-07-08 #33633, Upstream PR gh: ipsec: clarify check for leaked proxy traffic during key rotation #33509, @julianwiedmann)
• gha: Only retrieve IPv4 CIDR from docker network (Backport PR v1.13 Backports 2024-06-13 #33112, Upstream PR gha: Only retrieve IPv4 CIDR from docker network #33093, @sayboras)

Misc Changes:

• .github: add workflow for renovate to build base images (Backport PR [v1.13] .github: add workflow for renovate to build base images #33348, Upstream PR .github: add workflow for renovate to build base images #33326, @aanm)
• .github: fix cloud workflows for renovate (Backport PR v1.13: run CI automatically for renovate #33315, Upstream PR .github: fix cloud workflows for renovate #33320, @aanm)
• .github: fix worfklows used by renovate (Backport PR v1.13: run CI automatically for renovate #33315, Upstream PR .github: fix worfklows used by renovate #33309, @aanm)
• [v1.13] - remove tracking of backports with MLH ([v1.13] - remove tracking of backports with MLH #33126, @aanm)
• Add auto-merge for renovate for trusted dependencies (Backport PR v1.13: run CI automatically for renovate #33315, Upstream PR Add auto-merge for renovate for trusted dependencies #33287, @aanm)
• build(deps): bump urllib3 from 2.0.7 to 2.2.2 in /Documentation (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR build(deps): bump urllib3 from 2.0.7 to 2.2.2 in /Documentation #33218, @dependabot[bot])
• build-images-base: cancel github runs based on branch name (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR build-images-base: cancel github runs based on branch name #33353, @aanm)
• build-images-base: push to branch if pull request ref doesn't exist (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR build-images-base: push to branch if pull request ref doesn't exist #33368, @aanm)
• build-images: fetch artifacts with specific pattern (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR build-images: fetch artifacts with specific pattern #33216, @aanm)
• chore(deps): update all github action dependencies (v1.13) (chore(deps): update all github action dependencies (v1.13) #33193, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.13) (chore(deps): update all github action dependencies (v1.13) #33209, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.13) (chore(deps): update all github action dependencies (v1.13) #33370, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.13) (chore(deps): update all github action dependencies (v1.13) #33499, @cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.17.8 (v1.13) (chore(deps): update docker.io/library/alpine docker tag to v3.17.8 (v1.13) #33367, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.11 docker digest to 2eb85b8 (v1.13) (chore(deps): update docker.io/library/golang:1.21.11 docker digest to 2eb85b8 (v1.13) #33189, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.11 docker digest to b405b62 (v1.13) (chore(deps): update docker.io/library/golang:1.21.11 docker digest to b405b62 (v1.13) #33366, @cilium-renovate[bot])
• chore(deps): update docker/build-push-action action to v5.4.0 (v1.13) (chore(deps): update docker/build-push-action action to v5.4.0 (v1.13) #33025, @cilium-renovate[bot])
• chore(deps): update go to v1.21.12 (v1.13) (chore(deps): update go to v1.21.12 (v1.13) #33541, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.13) (patch) (chore(deps): update stable lvh-images (v1.13) (patch) #33008, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.13) (patch) (chore(deps): update stable lvh-images (v1.13) (patch) #33192, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.13) (patch) (chore(deps): update stable lvh-images (v1.13) (patch) #33344, @cilium-renovate[bot])
• Creation of the /hello endpoint is delayed until the host datapath has been initialized. (Backport PR [v1.13] health: only launch /hello after host datapath is ready #33253, Upstream PR health: only launch /hello after host datapath is ready #27392, @lmb)
• daemon: Allow DNS transparent mode to be turned off with encryption (Backport PR v1.13 Backports 2024-07-02 #33532, Upstream PR daemon: Allow DNS transparent mode to be turned off with encryption #33420, @gandro)
• docs: Improve note on kube-apiserver entity limitations (Backport PR v1.13 Backports 2024-07-02 #33532, Upstream PR docs: Improve note on kube-apiserver entity limitations #33382, @gandro)
• docs: ipsec: mention dependency on transparent mode for DNS proxy (Backport PR v1.13 Backports 2024-06-12 #33100, Upstream PR docs: ipsec: mention dependency on transparent mode for DNS proxy #33062, @julianwiedmann)
• docs: ipsec: remove limitation for native-routing with L7 egress policy (Backport PR [1.13-backport] ipsec: Fix unencrypted traffic when IPsec is used with L7 egress proxy #31977, Upstream PR docs: ipsec: remove limitation for native-routing with L7 egress policy #32906, @julianwiedmann)
• Documentation: accept ORG and REPO (Backport PR v1.13 Backports 2024-07-02 #33532, Upstream PR Documentation: accept ORG and REPO #33514, @aanm)
• Fix renovate's concurrency group (Backport PR v1.13 Backports 2024-07-03 #33563, Upstream PR Fix renovate's concurrency group #33528, @aanm)
• install/kubernetes: update nodeinit image to latest version (Backport PR v1.13 Backports 2024-07-02 #33532, Upstream PR install/kubernetes: update nodeinit image to latest version #33427, @marseel)
• Miscellaneous improvements to clustermesh-related troubleshooting tools (Backport PR v1.13 Backports 2024-06-25 #33376, Upstream PR Miscellaneous improvements to clustermesh-related troubleshooting tools #32951, @giorio94)
• pkg/endpoint: do not rely on bpf_host.o to detect host endpoint (Backport PR [v1.13] health: only launch /hello after host datapath is ready #33253, Upstream PR pkg/endpoint: do not rely on bpf_host.o to detect host endpoint #32521, @lmb)
• pkg/endpoint: make state synchronization atomic (Backport PR [v1.13] health: only launch /hello after host datapath is ready #33253, Upstream PR pkg/endpoint: make state synchronization atomic #32439, @lmb)
• Renovate changes (Backport PR v1.13 Backports 2024-07-03 #33563, Upstream PR Renovate changes #33519, @aanm)
• renovate: add auto-approve bot for renovate PRs (Backport PR [v1.13] renovate: add auto-approve bot for renovate PRs #33644, Upstream PR renovate: add auto-approve bot for renovate PRs #33604, @aanm)

Other Changes:

• [1.13] Instruct users to manually clean stale routing rules after downgrade ([1.13] Instruct users to manually clean stale routing rules after downgrade #33079, @jschwinger233)
• [v1.13] ci: ipsec-e2e: fine-tune L7 proxy check ([v1.13] ci: ipsec-e2e: fine-tune L7 proxy check #33576, @julianwiedmann)
• envoy: Bump golang version to v1.22.5 (envoy: Bump golang version to v1.22.5 #33554, @sayboras)
• envoy: Update envoy 1.28.x to v1.28.5 (envoy: Update envoy 1.28.x to v1.28.5 #33481, @sayboras)
• github: fix concurrency groups for push events (github: fix concurrency groups for push events #33646, @aanm)
• install: Update image digests for v1.13.17 (install: Update image digests for v1.13.17 #33017, @qmonnet)