v1.16.0 release

[joestringer]

Setup preparation

• Depending on your OS, make sure Docker is running
• Export a GITHUB_TOKEN that has access to the repository
• Make sure a setup (GPG, SSH, S/MIME) is in place for signing tags with Git
• Make sure the GOPATH environment variable is set and pointing to the relevant path
• Make sure the Cilium helm charts and release repositories are installed locally:
  • Run git clone https://github.com/cilium/charts.git "$GOPATH/src/github.com/cilium/charts"
  • Run git clone https://github.com/cilium/release.git "$GOPATH/src/github.com/cilium/release"

    • If you already have the repo checked out, make sure the release binary is up to date:

      git checkout master && git pull && make
      

Pre-release

• Announce in Cilium slack channel #launchpad: Starting v1.16.0 release process :ship:
• Create a thread for that message and ping current top-hat to not merge any
  PRs until the release process is complete.
• Check that there are no release blockers for the targeted release version
• Ensure that outstanding backport PRs are merged
• Check with @cilium/security team if there are any security fixes to include
  in the release.
• 🆕 ./release start --steps 1-pre-check --target-version v1.16.0 --repo-dir /var/git/cilium-1.16 --dry-run
  • Change directory to the local copy of Cilium repository.
  • Execute release --current-version 1.16.0 --next-dev-version 1.16.1 to
    automatically move any unresolved issues/PRs from old release project
    into the new project. The release binary is located in the
    current repository.
    ⚠️ This command is broken after GitHub disabled projects.
• Push a PR including the changes necessary for the new release:
  • Pull latest changes from the branch being released
  • The next step will generate a CHANGELOG.md that will not be correct.
    That is expected, and it is fixed with a follow-up step. Don't worry.
  • 🆕 ./release start --steps 2 --target-version v1.16.0 --repo-dir /var/git/cilium-1.16 --dry-run --previous-version v1.15.7
    ⚠️ Even with --dry-run, this pushed the PR before I could complete the following steps. Furthermore, the steps below with "⚠️" are manual steps not covered by current release tool implementation. Filed Running the release tool with --dry-run should not post PRs #245 .
  • Run ../release/internal/start-release.sh 1.16.0 <GH-PROJECT> 1.15
    Note that this script produces some files at the root of the Cilium
    repository, and that these files are required at a later step for
    tagging the release.
  • ⚠️rm CHANGELOG.md
  • ⚠️ Regenerate the log since the previous release with prep-changelog.sh <last-patch-release> v1.16.0
  • ⚠️ Check and edit the CHANGELOG.md to ensure all PRs have proper release notes
  • ⚠️ Edit the v1.16.0-changes.txt files locally to replace the text with "See CHANGELOG.md for more details"
  • ⚠️ Add the 'stable' tag as part of the GitHub workflow and remove the
    'stable' tag from the last stable branch.
    (Compared vs v1.15.0 to do this manually)
  • Commit all changes with title Prepare for release v1.16.0
  • Submit PR (../release/internal/submit-release.sh)
  • ⚠️ Submit a PR that removes the 'stable' tag from the last stable branch.
    • Remove stable tags from v1.15 releases cilium#33985
• Merge PR Prepare for release v1.16.0 cilium#33984
• Create and push both tags to GitHub (v1.16.0, 1.16.0)
  • Pull latest branch locally and run ../release/internal/tag-release.sh.
  • 🆕 ./release start --steps 3 --target-version v1.16.0 --repo-dir /var/git/cilium-1.16 --previous-version v1.15.7
• Ask a maintainer to approve the build in the following link (keep the URL
  of the GitHub run to be used later):
  Cilium Image Release builds
  • Check if all docker images are available before announcing the release:
    make -C install/kubernetes/ check-docker-images
• Get the image digests from the build process and make a commit and PR with
  these digests.
  • Run ../release/internal/post-release.sh URL to fetch the image
    digests and submit a PR to update these, use the URL of the GitHub
    run here
  • 🆕 Trigger via https://github.com/cilium/cilium/actions/workflows/release.yaml
  • Get someone to review the PR. Do not trigger the full CI suite, but
    wait for the automatic checks to complete. Merge the PR.
    install: Update image digests for v1.16.0 cilium#33994
• Update helm charts
  • Create helm charts artifacts in Cilium charts repository using
    cilium helm release tool for the v1.16.0 release.
  • 🆕 ./release start --steps 5 --target-version v1.16.0 --repo-dir /var/git/cilium-1.16 --previous-version v1.15.7 --charts-repo-dir /var/git/cilium-charts
  • Check the output of the chart workflow and see if the test was
    successful.
• Check read the docs configuration:
  • Set the default version and mark the EOL version as active, and
    hidden and configure the new minor version as active and not
    hidden in active versions.
  • Update algolia configuration search in docsearch-scraper-webhook.
• Check draft release from releases page
  • ⚠️ Somehow the draft wasn't created in the earlier steps this time. Had to manually create it.
  • Update the text at the top with 2-3 highlights of the release
  • Publish the release
• Announce the release in #general on Slack (Use [@]channel for v1.16.0)
• Update Grafana dashboards

Post-release

• Update the upgrade guide and roadmap for any features that changed status.
  • ⚠️ Upgrade guide was already taken care of by developers after branching
  • ⚠️ We already updated the roadmap during recent RC releases, is there anything to do during post-release steps?
• Prepare post-release changes to main branch using ../release/internal/bump-readme.sh
  • ⚠️ This script doesn't automatically add the new v1.16.0 release. I had to manually update the table.
  • ⚠️ The development release is still v1.16.0-rc.2 at this point so that part of the table ends up malformed and should not be updated at this time.
  • Make sure to update the .github/maintainers-little-helper.yaml so that
    upcoming PRs are tracked correctly for the next release.
  • Bump the main testsuite to upgrade from v1.16 branch to main
    • ⚠️ In practice this seemed to apply to ginkgo more than GHA.
  • echo 1.16.0 > stable.txt.
    • ⚠️ The file has existing form v1.16.0 so this step needs updating
  • echo '{"results":[{"slug":"v1.16"}]}' > Documentation/_static/stable-version.json.
    • ⚠️ The change here doesn't automatically show up in git add --patch, maybe because it's binary or is part of a .gitignore. Had to specifically add this file by name to include it in the PR.
  • For new minor version update security policy
  • Commit / amend the commit to add all of the changes above and push the PR.
  • Merge the post-release PR. Update the tree for v1.16.0 stable release cilium#34000
• Notify #development on Slack that deprecated features may now be removed.
• This is the list of links for known external installers that depend on
  the release process. Ideally, work toward updating external tools and
  guides to point to the new Cilium version. If you find where to submit
  the update, please add the relevant links to this template.
  • kops
  • kubespray
  • network policy
  • cluster administration networking
  • cluster administration addons