Skip to content

Commit 35e01e7

Browse files
benashzbenashz
authored
Merge branch 'main' into VAULT-22933/adopt-status-conditions-for-all-crds
2 parents 3e7ccd8 + c8b2074 commit 35e01e7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1010
-504
lines changed

‎.github/actions/integration-test/action.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ runs:
6767
cluster_name: ${{ inputs.kind-cluster-name }}
6868
config: test/integration/kind/config.yaml
6969
node_image: kindest/node:v${{ inputs.k8s-version }}
70-
version: "v0.27.0"
70+
version: "v0.30.0"
7171
- name: Create kind export log root
7272
id: create_kind_export_log_root
7373
shell: bash
@@ -101,6 +101,7 @@ runs:
101101
HCP_PROJECT_ID: ${{ inputs.hcp-project-id }}
102102
HCP_CLIENT_ID: ${{ inputs.hcp-client-id }}
103103
HCP_CLIENT_SECRET: ${{ inputs.hcp-client-secret }}
104+
SKIP_HCPVSAPPS_TESTS: "true"
104105
GITHUB_TOKEN: ${{ inputs.github-token }}
105106
# used by scripts that fetch build tools from GH
106107
GH_GET_RETRIES: 5

‎.github/pull_request_template.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
## PCI review checklist
2+
3+
<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
4+
5+
- [ ] I have documented a clear reason for, and description of, the change I am making.
6+
7+
- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
8+
9+
- [ ] If applicable, I've documented the impact of any changes to security controls.
10+
11+
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

‎.github/workflows/build.yaml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ jobs:
8989
- run: npm install -g bats@${BATS_VERSION}
9090
shell: bash
9191
env:
92-
BATS_VERSION: '1.10.0'
92+
BATS_VERSION: '1.12.0'
9393
- run: bats -v
9494
shell: bash
9595
- run: make unit-test
@@ -348,11 +348,11 @@ jobs:
348348
- run: echo "setting versions"
349349
outputs:
350350
# JSON encoded array of k8s versions
351-
K8S_VERSIONS: '["1.32.3", "1.31.6", "1.30.10", "1.29.14", "1.28.15"]'
352-
VAULT_N: "1.19.0"
353-
VAULT_N_1: "1.18.5"
354-
VAULT_N_2: "1.17.12"
355-
VAULT_LTS_1: "1.16.16"
351+
K8S_VERSIONS: '["1.33.4", "1.32.8", "1.31.12", "1.30.13", "1.29.14"]'
352+
VAULT_N: "1.20.3"
353+
VAULT_N_1: "1.19.9"
354+
VAULT_N_2: "1.18.14"
355+
VAULT_LTS_1: "1.16.25"
356356
oom-tests:
357357
runs-on: ubuntu-latest
358358
needs:
@@ -375,7 +375,7 @@ jobs:
375375
- name: Install kind
376376
uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
377377
with:
378-
version: "v0.27.0"
378+
version: "v0.30.0"
379379
install_only: true
380380
- uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
381381
id: setup-helm

‎.github/workflows/jira.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ jobs:
1414
JIRA_SYNC_USER_EMAIL: ${{ secrets.JIRA_SYNC_USER_EMAIL }}
1515
JIRA_SYNC_API_TOKEN: ${{ secrets.JIRA_SYNC_API_TOKEN }}
1616
with:
17-
teams-array: '["ecosystem", "foundations-eco", "vault-eco"]'
17+
teams-array: '["vault-eco-infra"]'

‎.go-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.23.6
1+
1.24.7

‎.release/security-scan.hcl

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,16 @@
11
# Copyright (c) HashiCorp, Inc.
22
# SPDX-License-Identifier: BUSL-1.1
33

4-
container {
5-
dependencies = true
6-
alpine_secdb = true
7-
secrets {
8-
all = true
9-
}
10-
}
11-
124
binary {
5+
go_stdlib = true // Scan the Go standard library used to build the binary.
6+
go_modules = true // Scan the Go modules included in the binary.
7+
osv = true // Use the OSV vulnerability database.
8+
oss_index = true // And use OSS Index vulnerability database.
9+
1310
secrets {
1411
all = true
1512
}
16-
go_modules = true
17-
osv = true
18-
oss_index = false
19-
nvd = false
13+
2014
triage {
2115
suppress {
2216
vulnerabilities = [
@@ -29,3 +23,12 @@ binary {
2923
}
3024
}
3125
}
26+
27+
container {
28+
dependencies = true // Scan any installed packages for vulnerabilities.
29+
osv = true // Use the OSV vulnerability database.
30+
31+
secrets {
32+
all = true
33+
}
34+
}

‎Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,12 +94,12 @@ ENTRYPOINT ["/vault-secrets-operator"]
9494

9595
# ubi build image
9696
# -----------------------------------
97-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.5 AS build-ubi
97+
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6 AS build-ubi
9898
RUN microdnf --refresh --assumeyes upgrade ca-certificates
9999

100100
# ubi release image
101101
# -----------------------------------
102-
FROM registry.access.redhat.com/ubi9/ubi-micro:9.5 AS release-ubi
102+
FROM registry.access.redhat.com/ubi9/ubi-micro:9.6 AS release-ubi
103103

104104
ENV BIN_NAME=vault-secrets-operator
105105
ARG PRODUCT_VERSION

‎chart/templates/_helpers.tpl

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,3 +345,17 @@ clientCache numLocks
345345
{{- end -}}
346346
{{- end -}}
347347
{{- end -}}
348+
349+
{{/*
350+
topologySpreadConstraints appends the "vso.chart.selectorLabels" to .Values.controller.topologySpreadConstraints if no labelSelector was specified
351+
*/}}
352+
{{- define "vso.topologySpreadConstraints" -}}
353+
{{- $defaultLabelSelector := dict "labelSelector" (dict "matchLabels" (include "vso.chart.selectorLabels" . | fromYaml)) -}}
354+
{{- range $topologySpreadConstraint := .Values.controller.topologySpreadConstraints -}}
355+
{{- if hasKey $topologySpreadConstraint "labelSelector" -}}
356+
{{- $topologySpreadConstraint | list | toYaml -}}
357+
{{- else -}}
358+
{{- merge $topologySpreadConstraint $defaultLabelSelector | list | toYaml -}}
359+
{{- end -}}
360+
{{- end -}}
361+
{{- end -}}

‎chart/templates/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,9 @@ spec:
141141
volumeMounts:
142142
- mountPath: /var/run/podinfo
143143
name: podinfo
144+
{{- if .Values.controller.priorityClassName }}
145+
priorityClassName: {{ .Values.controller.priorityClassName }}
146+
{{- end }}
144147
securityContext:
145148
{{- toYaml .Values.controller.podSecurityContext | nindent 8 }}
146149
serviceAccountName: {{ include "vso.chart.fullname" . }}-controller-manager
@@ -161,6 +164,10 @@ spec:
161164
affinity:
162165
{{- toYaml .Values.controller.affinity | nindent 8 }}
163166
{{- end }}
167+
{{- if .Values.controller.topologySpreadConstraints }}
168+
topologySpreadConstraints:
169+
{{- include "vso.topologySpreadConstraints" . | nindent 8 }}
170+
{{- end }}
164171
volumes:
165172
- downwardAPI:
166173
items:
@@ -220,6 +227,9 @@ spec:
220227
securityContext:
221228
{{- toYaml .| nindent 10 }}
222229
{{- end}}
230+
{{- if .Values.controller.priorityClassName }}
231+
priorityClassName: {{ .Values.controller.priorityClassName }}
232+
{{- end }}
223233
restartPolicy: Never
224234
{{- with .Values.controller.nodeSelector }}
225235
nodeSelector:

‎chart/templates/hook-upgrade-crds.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,9 @@ spec:
106106
securityContext:
107107
{{- toYaml .| nindent 10 }}
108108
{{- end}}
109+
{{- if .Values.controller.priorityClassName }}
110+
priorityClassName: {{ .Values.controller.priorityClassName }}
111+
{{- end }}
109112
restartPolicy: Never
110113
{{- with .Values.controller.nodeSelector }}
111114
nodeSelector:

0 commit comments

Comments
 (0)