FYI, now that the release is actually there I've re-triggered the kind workflow which was previously failing due to the release not existing yet.

We need a test commit to run the workflows with this version, right?

In the test PR we did get a DNS failure still, in https://github.com/cilium/cilium/actions/runs/1277574393 during the second connectivity test (with encryption enabled) :/

DNS is always the first thing to fail when there are connectivity issues, so that's not really a distinguishing feature ;-)

I don't see any to-proxy traces in tests without proxy redirects, so I don't think those failures are the same issue.

Note the to-proxy failure may still happen in connectivity checks after IPsec (though it doesn't appear to be the case here) because, even though we reordered tests in the checks, the first few tests after enabling IPsec may still conflict with the last few tests before enabling IPsec. A fix for that could be to flush the conntrack map in between the two connectivity check runs in our workflows. Nevertheless, I'd rather wait to see how prevalent that issue is before sending such a fix.

repushed a commit with proper formatting, bpf job was complaining about lack of commit description

Should this PR be marked with needs-backport/v1.10? See this PR that is going to be backported (backport PR).

Should this PR be marked with needs-backport/v1.10? See this PR that is going to be backported (backport PR).

Yes, it should be backported so that the Kind workflow uses the right CLI version.