Update Cilium to 1.16.3 (#803)

---------

Co-authored-by: Benjamin Schimke <[email protected]>

build-scripts/hack/generate-sbom.py

@@ -139,7 +139,7 @@ def k8s_snap_c_dqlite_components(manifest, extra_files):
 def rock_cilium(manifest, extra_files):
     LOG.info("Generating SBOM info for Cilium rocks")
 
-    cilium_version = "1.15.2"
+    cilium_version = "1.16.3"
 
     with util.git_repo(CILIUM_ROCK_REPO, CILIUM_ROCK_TAG) as d:
         rock_repo_commit = util.parse_output(["git", "rev-parse", "HEAD"], cwd=d)

build-scripts/hack/update-gateway-api-chart.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-VERSION="v1.0.0"
+VERSION="v1.1.0"
 DIR=`realpath $(dirname "${0}")`
 
 CHARTS_PATH="$DIR/../../k8s/components/charts"
@@ -16,7 +16,6 @@ rm -rf gateway-api/templates/*
 rm -rf gateway-api/charts
 cp gateway-api-src/config/crd/standard/* gateway-api/templates/
 cp gateway-api-src/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml gateway-api/templates/
-cp gateway-api-src/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml gateway-api/templates/
 sed -i 's/^\(version: \).*$/\1'"${VERSION:1}"'/' gateway-api/Chart.yaml
 sed -i 's/^\(appVersion: \).*$/\1'"${VERSION:1}"'/' gateway-api/Chart.yaml
 sed -i 's/^\(description: \).*$/\1'"A Helm Chart containing Gateway API CRDs"'/' gateway-api/Chart.yaml

src/k8s/pkg/client/helm/client.go

@@ -94,7 +94,7 @@ func (h *client) Apply(ctx context.Context, c InstallableChart, desired State, v
 		// there is already a release installed, so we must run an upgrade action
 		upgrade := action.NewUpgrade(cfg)
 		upgrade.Namespace = c.Namespace
-		upgrade.ReuseValues = true
+		upgrade.ResetThenReuseValues = true
 
 		chart, err := loader.Load(filepath.Join(h.manifestsBaseDir, c.ManifestPath))
 		if err != nil {

src/k8s/pkg/k8sd/features/cilium/chart.go

@@ -11,7 +11,7 @@ var (
 	ChartCilium = helm.InstallableChart{
 		Name:         "ck-network",
 		Namespace:    "kube-system",
-		ManifestPath: filepath.Join("charts", "cilium-1.15.2.tgz"),
+		ManifestPath: filepath.Join("charts", "cilium-1.16.3.tgz"),
 	}
 
 	// ChartCiliumLoadBalancer represents manifests to deploy Cilium LoadBalancer resources.
@@ -25,7 +25,7 @@ var (
 	chartGateway = helm.InstallableChart{
 		Name:         "ck-gateway",
 		Namespace:    "kube-system",
-		ManifestPath: filepath.Join("charts", "gateway-api-1.0.0.tgz"),
+		ManifestPath: filepath.Join("charts", "gateway-api-1.1.0.tgz"),
 	}
 
 	// chartGatewayClass represents a manifest to deploy a GatewayClass called ck-gateway.
@@ -39,11 +39,11 @@ var (
 	ciliumAgentImageRepo = "ghcr.io/canonical/cilium"
 
 	// CiliumAgentImageTag is the tag to use for the cilium-agent image.
-	CiliumAgentImageTag = "1.15.2-ck2"
+	CiliumAgentImageTag = "1.16.3-ck0"
 
 	// ciliumOperatorImageRepo is the image to use for cilium-operator.
 	ciliumOperatorImageRepo = "ghcr.io/canonical/cilium-operator"
 
 	// ciliumOperatorImageTag is the tag to use for the cilium-operator image.
-	ciliumOperatorImageTag = "1.15.2-ck2"
+	ciliumOperatorImageTag = "1.16.3-ck0"
 )

src/k8s/pkg/k8sd/features/cilium/cleanup.go

@@ -14,7 +14,7 @@ func CleanupNetwork(ctx context.Context, snap snap.Snap) error {
 	os.Remove("/var/run/cilium/cilium.pid")
 
 	if _, err := os.Stat("/opt/cni/bin/cilium-dbg"); err == nil {
-		if err := exec.CommandContext(ctx, "/opt/cni/bin/cilium-dbg", "cleanup", "--all-state", "--force").Run(); err != nil {
+		if err := exec.CommandContext(ctx, "/opt/cni/bin/cilium-dbg", "post-uninstall-cleanup", "--all-state", "--force").Run(); err != nil {
 			return fmt.Errorf("cilium-dbg cleanup failed: %w", err)
 		}
 	}

src/k8s/pkg/k8sd/features/cilium/network.go

@@ -120,6 +120,9 @@ func ApplyNetwork(ctx context.Context, snap snap.Snap, localhostAddress string,
 				"clusterPoolIPv6PodCIDRList": ipv6CIDR,
 			},
 		},
+		"envoy": map[string]any{
+			"enabled": false, // 1.16+ installs envoy as a standalone daemonset by default if not explicitly disabled
+		},
 		// https://docs.cilium.io/en/v1.15/network/kubernetes/kubeproxy-free/#kube-proxy-hybrid-modes
 		"nodePort":                 ciliumNodePortValues,
 		"disableEnvoyVersionCheck": true,