fix(deps): update module github.com/cilium/cilium to v1.16.0-rc.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/cilium/cilium	v1.16.0-rc.1 -> v1.16.0-rc.2

---

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.16.0-rc.2: 1.16.0-rc.2

Compare Source

Summary of Changes

Minor Changes:

• Add kubernetes validations to ensure CiliumLocalRedirectPolicy fields are immutable as policy updates are not supported.(Backport PR #​33804, Upstream PR #​33640, @​chaunceyjiang)
• EGW NAT Stats Troubleshooting & EGW Docs Structure Improvements(Backport PR #​33804, Upstream PR #​33416, @​tommyp1ckles)
• envoy: Update envoy 1.29.x to v1.29.7(Backport PR #​33630, Upstream PR #​33486, @​sayboras)
• helm: Add possibility to control creation of GatewayClass(Backport PR #​33630, Upstream PR #​33446, @​balous)
• ipsec: Deprecate global IPsec keys(Backport PR #​33630, Upstream PR #​33504, @​pchaigno)

Bugfixes:

• auth: fix fatal error: concurrent map iteration and map write(Backport PR #​33804, Upstream PR #​33634, @​chaunceyjiang)
• cert: Adding H2 Protocol Support when Get gRPC Config For Client(Backport PR #​33804, Upstream PR #​33616, @​mrproliu)
• Correctly remove data cached by KVStoreMesh for a given cluster when disconnecting from such cluster(Backport PR #​33630, Upstream PR #​33153, @​giorio94)
• DNS Proxy: Allow SO_LINGER to be set to the socket to upstream(Backport PR #​33804, Upstream PR #​33592, @​gandro)
• envoy: Avoid short circuit backend filtering(Backport PR #​33630, Upstream PR #​33403, @​sayboras)
• Fix CNP/CCNP update when selectors change from nil to empty non-nil slices(Backport PR #​33804, Upstream PR #​33506, @​pippolo84)
• Fix configuration generated from Helm values for hubble-drop-events-reasons to use a whitespace item separator(Backport PR #​33804, Upstream PR #​33699, @​EricMountain)
• Fix rare race condition afflicting clustermesh while stopping the retrieval of the remote cluster configuration, possibly causing a deadlock(Backport PR #​33804, Upstream PR #​33735, @​giorio94)
• Fix too many open Unix sockets(Backport PR #​33630, Upstream PR #​33569, @​chaunceyjiang)
• Fixes a missing rev-DNAT issue when wireguard, nodeport, KPR, and L7 proxy are enabled together.(Backport PR #​33804, Upstream PR #​33426, @​jschwinger233)
• Fixes a race condition during agent startup that causes the k8s node label updates to not get propagated to the host endpoint.(Backport PR #​33630, Upstream PR #​33511, @​skmatti)
• ipsec: do not nil out EncryptInterface when using IPAM ENI on netlink…(Backport PR #​33630, Upstream PR #​33512, @​jasonaliyetti)
• IPv6 and IPv4 '0.0.0.0/0' CIDR parsing in policy processing has been fixed(Backport PR #​33630, Upstream PR #​33448, @​jrajahalme)
• Report the correct drop reason when a packet is dropped by the bpf_lxc program.(Backport PR #​33630, Upstream PR #​33551, @​julianwiedmann)
• Skip regenerating host endpoint on k8s node labels update if identity labels are unchanged(Backport PR #​33804, Upstream PR #​33306, @​skmatti)
• socketlb: tolerate cgroupv1 when detaching bpf programs(Backport PR #​33630, Upstream PR #​33599, @​rgo3)
• The cilium agent now cleans up stale nodeID mappings and other node-related state on startup(Backport PR #​33630, Upstream PR #​33278, @​bimmlerd)
• Update IPsec to handle larger PSK values when using per-tunnel PSK(Backport PR #​33630, Upstream PR #​33472, @​jasonaliyetti)
• When the Bandwidth Manager feature is enabled, don't apply Egress rate-limiting to "Port unreachable" ICMP replies by Cilium's North-South Loadbalancer.(Backport PR #​33630, Upstream PR #​33624, @​julianwiedmann)

CI Changes:

• [v1.16] ci: Add call backport label udpater workflow(#​33759, @​pippolo84)
• Bump CLI to v0.16.11(Backport PR #​33630, Upstream PR #​33444, @​brb)
• ci: Set cluster id in external workloads(Backport PR #​33804, Upstream PR #​33694, @​marseel)
• gh: ipsec: clarify check for leaked proxy traffic during key rotation(Backport PR #​33630, Upstream PR #​33509, @​julianwiedmann)
• gha: Add http client timeout in Ingress(Backport PR #​33804, Upstream PR #​33683, @​sayboras)
• release image: Allow arbitrary pre-release identifiers(#​33718, @​michi-covalent)
• workflow: Use per-tunnel keys for the IPsec upgrade test(Backport PR #​33804, Upstream PR #​33769, @​pchaigno)

Misc Changes:

• [v1.16] ginkgo: use net-next configuration with 6.6 kernel(#​33733, @​aanm)
• Add kernel version limitation to multicast Doc(Backport PR #​33630, Upstream PR #​33567, @​yushoyamaguchi)
• bgpv2: Fix description of Selector behavior in CiliumBGPAdvertisement CRD(Backport PR #​33630, Upstream PR #​33537, @​rastislavs)
• bgpv2: Skip reconcile while BGPNodeConfig is not initialized(Backport PR #​33630, Upstream PR #​33526, @​rastislavs)
• bpf: lxc: use THIS_INTERFACE_IFINDEX instead of CB_IFINDEX(Backport PR #​33630, Upstream PR #​33524, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.16)(#​33478, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16)(#​33622, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16)(#​33788, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16)(#​33602, @​cilium-renovate[bot])
• chore(deps): update cilium/little-vm-helper action to v0.0.19 (v1.16)(#​33790, @​cilium-renovate[bot])
• chore(deps): update go to v1.22.5 (v1.16)(#​33566, @​cilium-renovate[bot])
• chore(deps): update kindest/node docker tag to v1.30.2 (v1.16)(#​33521, @​cilium-renovate[bot])
• chore(deps): update quay.io/lvh-images/kind docker tag to bpf-20240628.013131 (v1.16)(#​33480, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch)(#​33620, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch)(#​33791, @​cilium-renovate[bot])
• Cleanup: no need to deactivate l7proxy when activating EgressGetway(Backport PR #​33630, Upstream PR #​33516, @​cdtzabra)
• daemon: add agent-runtime-config backup files to gitignore(Backport PR #​33630, Upstream PR #​33485, @​mhofstetter)
• daemon: Allow DNS transparent mode to be turned off with encryption(Backport PR #​33630, Upstream PR #​33420, @​gandro)
• docs,LRP: Add steps to restart agent and operator pods and update feature roadmap status(Backport PR #​33804, Upstream PR #​33655, @​aditighag)
• docs: Add node about socketLB.hostNamespaceOnly to Kata page(Backport PR #​33804, Upstream PR #​33725, @​brb)
• docs: Add Port Range Information(Backport PR #​33630, Upstream PR #​33389, @​nathanjsweet)
• docs: add upgrade note for dangling cidrGroupRefs(Backport PR #​33630, Upstream PR #​33445, @​bimmlerd)
• docs: cleanup upgrade docs on 1.16(#​33703, @​marseel)
• docs: Document plus sign in IPsec secret(Backport PR #​33630, Upstream PR #​33564, @​pchaigno)
• docs: Improve Ingress documentation(Backport PR #​33804, Upstream PR #​33698, @​youngnick)
• docs: remove beta from local redirect policy page(Backport PR #​33630, Upstream PR #​33498, @​ysksuzuki)
• docs: Remove CNCF graduation from the roadmap(Backport PR #​33804, Upstream PR #​33680, @​joestringer)
• docs: remove mention of outdated clustermesh + L7 policies + tunnel limitation(Backport PR #​33804, Upstream PR #​33626, @​giorio94)
• docs: Update LVH VM image pull instructions(Backport PR #​33804, Upstream PR #​33621, @​brb)
• Documentation: accept ORG and REPO(Backport PR #​33630, Upstream PR #​33514, @​aanm)
• Documentation: Add --set cni.exclusive=false for Azure Chain Mode(Backport PR #​33804, Upstream PR #​33708, @​Mais316)
• Fix container/bitlpm traversal(Backport PR #​33630, Upstream PR #​33447, @​jrajahalme)
• Fix issue where ec2-api-endpoint config would use the incorrect API endpoint.(Backport PR #​33804, Upstream PR #​33598, @​archerwu9425)
• fix link in node-ipam.rst(Backport PR #​33630, Upstream PR #​33505, @​saintdle)
• Fix loading of program cil_sock{4,6}_connect due to verifier complexity issue on certain kernels.(Backport PR #​33804, Upstream PR #​33709, @​aditighag)
• Fix renovate's concurrency group(Backport PR #​33560, Upstream PR #​33528, @​aanm)
• Low hanging fruit performance improvements of KVStoreMesh(Backport PR #​33804, Upstream PR #​33637, @​giorio94)
• LRP: Misc fix-ups(Backport PR #​33630, Upstream PR #​33442, @​aditighag)
• option: Make TestDaemonConfig_StoreInFile less brittle(Backport PR #​33804, Upstream PR #​33608, @​jrajahalme)
• policy/k8s: Fix deadlock in ToServices implementation(Backport PR #​33825, Upstream PR #​33739, @​gandro)
• policy: Fix mapstate.Diff() used in tests(Backport PR #​33630, Upstream PR #​33449, @​jrajahalme)
• Renovate changes(Backport PR #​33560, Upstream PR #​33519, @​aanm)
• renovate: add auto-approve bot for renovate PRs(Backport PR #​33641, Upstream PR #​33604, @​aanm)
• renovate: onboard etcd image used in integration tests(Backport PR #​33804, Upstream PR #​33679, @​giorio94)
• upgrade-notes: add information about kvstoremesh and external workloads(#​33695, @​marseel)
• wireguard: minor improvements for to-wireguard program(Backport PR #​33804, Upstream PR #​33764, @​julianwiedmann)

Other Changes:

• [v1.16] datapath: Fix update to NodeAddress table and prioritize Node IP(#​33817, @​joamaki)
• install: Update image digests for v1.16.0-rc.1(#​33464, @​joestringer)

Docker Manifests

quay.io/cilium/cilium:v1.16.0-rc.2@​sha256:e7a463fb48043db42560a11a883a48c6170a0ae5847ebfb8a7dee8726dbf94c7
quay.io/cilium/clustermesh-apiserver:v1.16.0-rc.2@​sha256:1247c55d0eaf57ccc3616a192475147acf41ce81c81ae5006895bc24a0187e0b
quay.io/cilium/docker-plugin:v1.16.0-rc.2@​sha256:4f5a6dd6aceaf2692974072c05c900d9b7a203798fa346f6796ef6570242107f
quay.io/cilium/hubble-relay:v1.16.0-rc.2@​sha256:a12082f420adf138338b39e6de37e086b747e0d486cecf9447c44c8a8542909e
quay.io/cilium/operator-alibabacloud:v1.16.0-rc.2@​sha256:7a4637e02076f3507bfb83f05e371a5f5d96b00953d0167727da1716a193e876
quay.io/cilium/operator-aws:v1.16.0-rc.2@​sha256:8915e2a8ff527d5074a0f3203ef08abb45d93d9a035bd4d07397d85ee9ab43c5
quay.io/cilium/operator-azure:v1.16.0-rc.2@​sha256:89933617631e32054a932d4447047be628b938ef2fa1a09609b67218e191b983
quay.io/cilium/operator-generic:v1.16.0-rc.2@​sha256:0392b4ea5b3c53acfc5d202f3b3cc1fafe79ae2e64af0eb47e2c2775709091b0
quay.io/cilium/operator:v1.16.0-rc.2@​sha256:7811eb7e8a4ee1990f7a3876542f8aee9c87ff80b4a09167caec176fd95765a1

---

Configuration

📅 Schedule: Branch creation - "on friday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.