diff --git "a/.changes/unreleased/\360\237\244\226 CI & Build-20240608-002754.yaml" "b/.changes/unreleased/\360\237\244\226 CI & Build-20240608-002754.yaml" deleted file mode 100644 index bc906f7..0000000 --- "a/.changes/unreleased/\360\237\244\226 CI & Build-20240608-002754.yaml" +++ /dev/null @@ -1,3 +0,0 @@ -kind: "\U0001F916 CI & Build" -body: Add a buildName metadata to binary so easy to see if caching issue with container loading. Handle `dev.local/dsv-k8s` as standard image name to better reflect standard approach I've been using. Improve validation checks. Goreleaser upgrade schema and more. Lots of quality of life improvements for dev, and aqua updates. -time: 2024-06-08T00:27:54.636538807Z diff --git a/.changes/v1.2.3.md b/.changes/v1.2.3.md new file mode 100644 index 0000000..9e6f899 --- /dev/null +++ b/.changes/v1.2.3.md @@ -0,0 +1,11 @@ +## v1.2.3 - 2024-08-12 + + +### 🤖 CI & Build + +- Add a buildName metadata to binary so easy to see if caching issue with container loading. Handle `dev.local/dsv-k8s` as standard image name to better reflect standard approach I've been using. Improve validation checks. Goreleaser upgrade schema and more. Lots of quality of life improvements for dev, and aqua updates. + +### 🔨 Refactor + +- Improve `values.yml` for the dsv-injector to expose the days till expiration of the self signed cert. +Include minor doc improvements to this as well to better handle. \ No newline at end of file diff --git a/.golangci.yml b/.golangci.yml index ff813df..a8b4cad 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,22 +1,17 @@ --- output: - format: tab + formats: + - format: tab linters-settings: misspell: locale: US - gomnd: - settings: - mnd: - checks: [argument, case, condition, return] - ignored-functions: strconv.ParseFloat,rsa.GenerateKey + nolintlint: allow-unused: false - allow-leading-space: true allow-no-explanation: [] require-explanation: true require-specific: true gofumpt: - lang-version: '1.18' extra-rules: true godox: keywords: @@ -33,45 +28,45 @@ linters-settings: - ^[ ]*@ capital: true depguard: - list-type: blacklist - include-go-root: true - includeGoStdLib: true - packages: - - github.com/sirupsen/logrus - packages-with-error-message: - - github.com/sirupsen/logrus: logging is allowed only by zerolog. Please use zerolog - - io/ioutil: 'io/ioutil was deprecated in Go 1.16: https://tip.golang.org/doc/go1.16' - gomodguard: - blocked: - modules: - - github.com/sirupsen/logrus: - recommendations: - - internal/logging - reason: logging is allowed only by zerolog. Please use zerolog - local_replace_directives: false + rules: + main: + deny: + - pkg: 'github.com/sirupsen/logrus' + desc: use zerolog + - pkg: log + desc: use zerolog + - pkg: 'github.com/pkg/errors' + desc: Should be replaced by standard lib errors package + + # gomodguard: + # blocked: + # modules: + # - github.com/sirupsen/logrus: + # recommendations: + # - internal/logging + # reason: logging is allowed only by zerolog. Please use zerolog + # local_replace_directives: false tagliatelle: case: use-field-name: true rules: - json: kebab + json: snake yaml: kebab xml: camel bson: camel avro: snake mapstructure: kebab - errcheck: - check-type-assertions: true - check-blank: false - ignore: fmt:.*,io/ioutil:^Read.* - exclude-functions: - - io/ioutil.ReadFile - - io.Copy(*bytes.Buffer) - - io.Copy(os.Stdout) - - io.Closer.Close - - io.Closer.Body.Close + errcheck: + check-type-assertions: true + check-blank: false + exclude-functions: + - io/ioutil.ReadFile + - io.Copy(*bytes.Buffer) + - io.Copy(os.Stdout) + - io.Closer.Close + - io.Closer.Body.Close govet: enable-all: true - check-shadowing: true disable: - fieldalignment settings: @@ -99,18 +94,22 @@ linters-settings: - ok - zl - fs - disable: - - fieldalignment + revive: ignore-generated-header: true - enableAllRules: true - exclude: - - .*_test.go + enable-all-rules: true rules: - name: var-naming severity: error + - name: line-length-limit + severity: warning + arguments: + - 400 + - name: function-length + severity: warning + arguments: [20, 5000] + linters: - exclude-use-default: false enable-all: true disable: - scopelint @@ -143,14 +142,12 @@ linters: - rowserrcheck # disabled due to generics, can enable in future if needed - sqlclosecheck # disabled due to generics, can enable in future if needed - wastedassign # disabled due to generics, can enable in future if needed + - funlen #OVERRIDE: ok using for bot, lots of quick long commands i worked on + - cyclop #OVERRIDE: ok using for bot, lots of quick long commands i worked on + - gocognit #OVERRIDE: ok using for bot, lots of quick long commands i worked on + run: - skip-dirs-use-default: true - skip-dirs: - - build - - artifacts - - _tools - - vendor - - vendor$ + timeout: 5m build-tags: - mage - tools @@ -182,6 +179,17 @@ issues: - maintidx - deadcode - gochecknoglobals + - path: magefile.go + linters: + - goerr113 + - wrapcheck + - funlen + - gocyclo + - cyclop + - gocognit + - maintidx + - deadcode + - gochecknoglobals - linters: - goerr113 text: magefiles don't need to worry about wrapping in the same way @@ -194,3 +202,12 @@ issues: - godot text: mocked files do not need to be checked whole-files: false + exclude-dirs: + - build + - .artifacts + - .cache + - artifacts + - .trunk + - _tools + - vendor + - vendor$ diff --git a/.markdownlint.yaml b/.markdownlint.yaml index a865d71..65fe925 100644 --- a/.markdownlint.yaml +++ b/.markdownlint.yaml @@ -1,6 +1,5 @@ --- #https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md002 -comment: my-markdown-linting-rules # enable all default tagged rules default: true @@ -43,13 +42,11 @@ MD025: true # This is for maintainability and code diffs. # Try applying semantic line break concept for breaking up longer phrases # https://sembr.org/ -MD013: - line_length: 200 +MD013: false # MD024/no-duplicate-heading/no-duplicate-header - Multiple headings with the same content # This tweaks to allow nested items to have duplicate headers. MD024: - # Only check sibling headings - allow_different_nesting: true # Only check sibling headings siblings_only: true +MD034: false diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..c12134b --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +v20.15.0 diff --git a/.tool-versions b/.tool-versions deleted file mode 100644 index 503c006..0000000 --- a/.tool-versions +++ /dev/null @@ -1 +0,0 @@ -nodejs 17.3.0 diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml index 151d42c..f9c82d3 100644 --- a/.trunk/trunk.yaml +++ b/.trunk/trunk.yaml @@ -45,11 +45,11 @@ lint: - linters: [gitleaks] level: high disabled: + - gokart - cspell - gofmt enabled: - checkov@3.2.128 - - gokart@0.5.1 - osv-scanner@1.7.4 - terrascan@1.19.1 - trivy@0.52.0 diff --git a/CHANGELOG.md b/CHANGELOG.md index cf42d11..2805dc2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html), and is generated by [Changie](https://github.com/miniscruff/changie). +## v1.2.3 - 2024-08-12 + +### 🤖 CI & Build + +- Add a buildName metadata to binary so easy to see if caching issue with container loading. Handle `dev.local/dsv-k8s` as standard image name to better reflect standard approach I've been using. Improve validation checks. Goreleaser upgrade schema and more. Lots of quality of life improvements for dev, and aqua updates. + +### 🔨 Refactor + +- Improve `values.yml` for the dsv-injector to expose the days till expiration of the self signed cert. + Include minor doc improvements to this as well to better handle. + ## v1.2.2 - 2024-01-15 ### âŦ†ī¸ Dependencies diff --git a/charts/dsv-injector/Chart.yaml b/charts/dsv-injector/Chart.yaml index 6a1bcab..8805680 100644 --- a/charts/dsv-injector/Chart.yaml +++ b/charts/dsv-injector/Chart.yaml @@ -8,7 +8,7 @@ description: | NAMESPACE='dsv' CREDENTIALS_JSON_FILE='.cache/credentials.json' # replace with your credentials file IMAGE_REPOSITORY='docker.io/delineaxpm/dsv-k8s' - IMAGE_TAG='v1.2.2' # use latest for test, but pin to a specific version for production + IMAGE_TAG='v1.2.3' # use latest for test, but pin to a specific version for production helm install \ --namespace $NAMESPACE \ @@ -18,10 +18,40 @@ description: | --set image.tag=${IMAGE_TAG} \ --atomic \ --timeout "5m" \ - --debug -v4 \ # optional --values ./myvaluesfile/values.yaml \ + --debug -v4 \ # optional for local test iteration --values .cache/charts/dsv-injector/values.yaml \ dsv-injector ./charts/dsv-injector ``` + An upgrade to the existing deployment can be done with: + + ```shell + helm upgrade \ + --namespace $NAMESPACE \ + --atomic \ + --timeout "5m" \ + --debug -v4 \ + dsv-injector ./charts/dsv-injector + ``` + + To upgrade, ensuring that the current self signed cert that is deployed by default (if not using your own CA), run the commands below to ensure the prior hook and secret are removed so they can be recreated with the newly generated cert. + + ```shell + kubectl --namespace $NAMESPACE delete mutatingwebhookconfiguration dsv-injector \ + && kubectl --namespace $NAMESPACE delete secret --timeout "5m" dsv-injector-tls \ + && helm upgrade \ + --namespace $NAMESPACE \ + --atomic \ + --timeout "5m" \ + --debug -v4 \ + dsv-injector ./charts/dsv-injector + ``` + + To uninstall the deployment, you can run: + + ```shell + helm uninstall --namespace $NAMESPACE dsv-injector + ``` + keywords: - Delinea - DevOps @@ -29,7 +59,7 @@ keywords: - secrets - vault type: application -version: v1.2.2 +version: v1.2.3 appVersion: latest maintainers: - name: Sheldon Hull diff --git a/charts/dsv-injector/README.md b/charts/dsv-injector/README.md index bd4de10..3afc06e 100644 --- a/charts/dsv-injector/README.md +++ b/charts/dsv-injector/README.md @@ -1,9 +1,57 @@ # dsv-injector -![Version: 0.2.3](https://img.shields.io/badge/Version-0.2.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) +![Version: v1.2.3](https://img.shields.io/badge/Version-v1.2.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) A Helm chart for the Delinea DevOps Secrets Vault (DSV) Injector Mutating Webhook. +```shell +NAMESPACE='dsv' +CREDENTIALS_JSON_FILE='.cache/credentials.json' # replace with your credentials file +IMAGE_REPOSITORY='docker.io/delineaxpm/dsv-k8s' +IMAGE_TAG='v1.2.3' # use latest for test, but pin to a specific version for production + +helm install \ + --namespace $NAMESPACE \ + --create-namespace \ + --set-file credentialsJson=${CREDENTIALS_JSON_FILE} \ + --set image.repository=${IMAGE_REPOSITORY} \ + --set image.tag=${IMAGE_TAG} \ + --atomic \ + --timeout "5m" \ + --debug -v4 \ # optional for local test iteration --values .cache/charts/dsv-injector/values.yaml \ + dsv-injector ./charts/dsv-injector +``` + +An upgrade to the existing deployment can be done with: + +```shell +helm upgrade \ + --namespace $NAMESPACE \ + --atomic \ + --timeout "5m" \ + --debug -v4 \ + dsv-injector ./charts/dsv-injector +``` + +To upgrade, ensuring that the current self signed cert that is deployed by default (if not using your own CA), run the commands below to ensure the prior hook and secret are removed so they can be recreated with the newly generated cert. + +```shell +kubectl --namespace $NAMESPACE delete mutatingwebhookconfiguration dsv-injector \ +&& kubectl --namespace $NAMESPACE delete secret --timeout "5m" dsv-injector-tls \ +&& helm upgrade \ + --namespace $NAMESPACE \ + --atomic \ + --timeout "5m" \ + --debug -v4 \ + dsv-injector ./charts/dsv-injector +``` + +To uninstall the deployment, you can run: + +```shell +helm uninstall --namespace $NAMESPACE dsv-injector +``` + ## Maintainers | Name | Email | Url | @@ -13,28 +61,34 @@ A Helm chart for the Delinea DevOps Secrets Vault (DSV) Injector Mutating Webhoo ## Values -| Key | Type | Default | Description | -| ------------------ | ------ | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| containerPort | int | `18543` | containerPort is the port that the container itself listens on | -| credentialsJson | string | `"{\n \"default\": {\n \"credentials\": {\n \"clientId\": \"\",\n \"clientSecret\": \"\"\n },\n \"tenant\": \"example\"\n }\n}"` | credentialsJson contains the JSON-formatted credentials file (see README.md) @default - placeholder. _REQUIRED FIELD_ | -| fullnameOverride | string | `""` | | -| image.entrypoint | string | `"/app/dsv-injector"` | Entrypoint is the path to the binary. Since the container image could contain multiple binaries, this makes sure it's correctly mapped to the binary. | -| image.pullPolicy | string | `"Always"` | | -| image.repository | string | `"docker.io/delineaxpm/dsv-k8s"` | | -| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| imagePullSecrets | list | `[]` | | -| nameOverride | string | `""` | | -| podAnnotations | object | `{}` | podAnnotations @default - Includes `dsv-filter-name` for easier log selector filter. | -| podSecurityContext | object | `{}` | | -| replicaCount | int | `1` | replicate count @default - 1 | -| resources | object | No default values, user must specify to set resource limits. | We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'. | -| securityContext | object | `{}` | | -| service.port | int | `8543` | Default port for the injector webhook service. @default -- port 8543 | -| service.type | string | `"ClusterIP"` | ClusterIP is typical when the webhook is running as a POD However, it can also be hosted externally, which is useful for debugging, by providing the following instead: type: ExternalName externalName: my.fqdn So long as: - my.fqdn hosts an HTTPS endpoint on port {webhookPort} that answers URI {webhookUri} - the certificate must have a Subject Alternative Name for {name}.{namespace}.{svc}, e.g., dsv-injector.dsv.svc - the caBundle must be a base64 string containing a PEM-encoded certificate chain that validates the certifcate caBundle: ... | -| webhookPort | int | 8543 | webhookPort is the port that the webhook endpoint is listening on | -| webhookScope | string | "Namespaced" | webhookScope specifies which resources are in scope, "Cluster", "Namespaced" or "\*" | -| webhookUri | string | `"/inject"` | webhookUri is path portion of the URL of the webhook endpoint | +| Key | Type | Default | Description | +| -------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| configmap | object | {} empty. | configmap are configuration values for the app to load. All of these are defaulted in the template itself and only need be set if adjusting. Since the user for the container is nonroot, only edit if you know what you are doing. Boolean values should be passed quoted to avoid issues. | +| containerPort | int | `18543` | containerPort is the port that the container itself listens on | +| credentialsJson | string | `"{\n \"default\": {\n \"credentials\": {\n \"clientId\": \"\",\n \"clientSecret\": \"\"\n },\n \"tenant\": \"example\"\n }\n}"` | credentialsJson contains the JSON-formatted credentials file (see README.md) @default - placeholder. _REQUIRED FIELD_ | +| fullnameOverride | string | `""` | | +| image.entrypoint | string | `"/app/dsv-injector"` | Entrypoint is the path to the binary. Since the container image could contain multiple binaries, this makes sure it's correctly mapped to the binary. | +| image.pullPolicy | string | IfNotPresent | pullPolicy is the image pull policy. If running locally built images, you'll want to set to Never to ensure local loaded images are used. Local testing use: `Never`. | +| image.repository | string | `"docker.io/delineaxpm/dsv-k8s"` | | +| image.tag | string | the current app version/chart version | Overrides the image tag whose default is the chart appVersion. Local Testing: Use `latest`. | +| imagePullSecrets | list | `[]` | | +| nameOverride | string | `""` | | +| podAnnotations | object | `{}` | podAnnotations @default - Includes `dsv-filter-name` for easier log selector filter. | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | replicate count @default - 1 | +| resources | object | No default values, user must specify to set resource limits. | We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'. | +| securityContext | object | `{"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532}` | securityContext is the security context for the controller. This uses chainguard static nonroot based image. Reference: https://edu.chainguard.dev/chainguard/chainguard-images/reference/static/overview/ | +| securityContext.readOnlyRootFilesystem | bool | true | readOnlyRootFilesystem is the read only root file system flag. | +| securityContext.runAsGroup | int | 65532 (from chainguard static image) | runAsGroup is the run as group. | +| securityContext.runAsNonRoot | bool | true | runAsNonRoot is the run as non root flag. | +| securityContext.runAsUser | int | 65532 (from chainguard static image) | runAsUser is the run as user. | +| service.port | int | `8543` | Default port for the injector webhook service. @default -- port 8543 | +| service.type | string | `"ClusterIP"` | ClusterIP is typical when the webhook is running as a POD However, it can also be hosted externally, which is useful for debugging, by providing the following instead: type: ExternalName externalName: my.fqdn So long as: - my.fqdn hosts an HTTPS endpoint on port {webhookPort} that answers URI {webhookUri} - the certificate must have a Subject Alternative Name for {name}.{namespace}.{svc}, e.g., dsv-injector.dsv.svc - the caBundle must be a base64 string containing a PEM-encoded certificate chain that validates the certifcate caBundle: ... | +| webhookCertExpireDays | int | 365 | webhookCertExpireDays specifies the number of days before the webhook certificate expires | +| webhookPort | int | 8543 | webhookPort is the port that the webhook endpoint is listening on | +| webhookScope | string | "Namespaced" | webhookScope specifies which resources are in scope, "Cluster", "Namespaced" or "\*" | +| webhookUri | string | `"/inject"` | webhookUri is path portion of the URL of the webhook endpoint | --- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/charts/dsv-injector/templates/NOTES.txt b/charts/dsv-injector/templates/NOTES.txt index e0d74dc..b76dcc2 100644 --- a/charts/dsv-injector/templates/NOTES.txt +++ b/charts/dsv-injector/templates/NOTES.txt @@ -3,7 +3,7 @@ {{- $uri := trimAll "/" .Values.webhookUri -}} ✨ Deployed: {{ include "dsv.fullname" . }} -📂 Namepsace: {{ .Release.Namespace }} +📂 Namespace: {{ .Release.Namespace }} {{ if eq .Values.service.type "ExternalName" }} 🔗 The cluster will call the webhook at {{ printf "https://%s:%d/%s" .Values.externalName $port $uri }} @@ -23,4 +23,10 @@ ⚙ī¸ ConfigMap created: {{ include "dsv.fullname" . }}-configmap {{ else }} ➖ no configmap detected, defaults used for logging level and any other configmap values -{{ end }} \ No newline at end of file +{{ end }} + +{{- if eq .Values.service.type "ExternalName" }} +ℹī¸ ExternalName provided for service type, so no self signed cert will be used. +{{- else -}} +➕ Will generate a self signed cert with expiration of [{{ (default 365 .Values.webhookCertExpireDays | int) }}] days. +{{- end -}} diff --git a/charts/dsv-injector/templates/deployment.yaml b/charts/dsv-injector/templates/deployment.yaml index 5247f0e..6788329 100644 --- a/charts/dsv-injector/templates/deployment.yaml +++ b/charts/dsv-injector/templates/deployment.yaml @@ -16,6 +16,7 @@ spec: metadata: {{- with .Values.podAnnotations }} annotations: + checksum/last-updated: {{ now | date "2006-01-02T15:04:05Z07:00" | quote }} {{- toYaml . | nindent 8 }} {{- end }} labels: @@ -59,4 +60,4 @@ spec: - name: cert secret: secretName: {{ include "dsv.name" . }}-tls -{{- end -}} \ No newline at end of file +{{- end -}} diff --git a/charts/dsv-injector/templates/webhook.yaml b/charts/dsv-injector/templates/webhook.yaml index c81f080..99e6627 100644 --- a/charts/dsv-injector/templates/webhook.yaml +++ b/charts/dsv-injector/templates/webhook.yaml @@ -1,5 +1,6 @@ {{- $tlsCert := genSelfSignedCert (include "dsv.dnsname" .) nil (list (include "dsv.dnsname" .) (include "dsv.name" .)) (default 365 .Values.webhookCertExpireDays | int) -}} -{{- $tlsSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-tls" (include "dsv.name" .)) -}} +{{- $existingTlsSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-tls" (include "dsv.name" .)) -}} + --- apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration @@ -7,6 +8,8 @@ metadata: name: {{ include "dsv.fullname" . }} labels: {{- include "dsv.labels" . | nindent 4 }} + annotations: + checksum/last-updated: {{ now | date "2006-01-02T15:04:05Z07:00" | quote }} webhooks: - name: {{ include "dsv.fullname" . }}.{{ .Release.Namespace }}.svc failurePolicy: Fail @@ -16,11 +19,11 @@ webhooks: operations: ["CREATE"] resources: ["secrets"] scope: {{ default "*" .Values.webhookScope }} - clientConfig: + clientConfig: # Secret Reference: Not supported directly by the MutatingWebhookConfiguration API. {{- if eq .Values.service.type "ExternalName" }} caBundle: {{ .Values.caBundle }} -{{- else if $tlsSecret }} - caBundle: {{ $tlsSecret.data.cert }} +{{ else if $existingTlsSecret }} + caBundle: {{ $existingTlsSecret.data.cert }} {{- else }} caBundle: {{ $tlsCert.Cert | b64enc }} {{- end }} @@ -37,13 +40,15 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "dsv.name" . }}-tls + annotations: + checksum/last-updated: {{ now | date "2006-01-02T15:04:05Z07:00" | quote }} data: -{{- if $tlsSecret }} - cert.pem: {{ $tlsSecret.data.cert }} - key.pem: {{ $tlsSecret.data.key }} +{{- if $existingTlsSecret }} + tls.crt: {{ $existingTlsSecret.data.cert }} + tls.key: {{ $existingTlsSecret.data.key }} {{- else }} - cert.pem: {{ $tlsCert.Cert | b64enc }} - key.pem: {{ $tlsCert.Key | b64enc }} + tls.crt: {{ $tlsCert.Cert | b64enc }} + tls.key: {{ $tlsCert.Key | b64enc }} {{- end }} -type: Opaque +type: kubernetes.io/tls {{- end }} diff --git a/charts/dsv-injector/values.yaml b/charts/dsv-injector/values.yaml index e1e9a5f..f44f10c 100644 --- a/charts/dsv-injector/values.yaml +++ b/charts/dsv-injector/values.yaml @@ -29,7 +29,7 @@ image: # -- Overrides the image tag whose default is the chart appVersion. # Local Testing: Use `latest`. # @default -- the current app version/chart version - tag: v1.2.2 + tag: v1.2.3 # -- Entrypoint is the path to the binary. Since the container image could contain multiple binaries, this makes sure it's correctly mapped to the binary. entrypoint: /app/dsv-injector @@ -120,3 +120,7 @@ configmap: # DSV_CREDENTIALS_JSON: # DSV_SERVER_ADDRESS: # DSV_DEBUG: 'true' # Warning: if passing boolean, use quoted string to avoid issues + +# -- webhookCertExpireDays specifies the number of days before the webhook certificate expires +# @default -- 365 +webhookCertExpireDays: 365 diff --git a/charts/dsv-syncer/Chart.yaml b/charts/dsv-syncer/Chart.yaml index a570fc6..5288b67 100644 --- a/charts/dsv-syncer/Chart.yaml +++ b/charts/dsv-syncer/Chart.yaml @@ -7,7 +7,7 @@ description: | ```shell NAMESPACE='dsv' IMAGE_REPOSITORY='docker.io/delineaxpm/dsv-k8s' - IMAGE_TAG='v1.2.2' # use latest for test, but pin to a specific version for production + IMAGE_TAG='v1.2.3' # use latest for test, but pin to a specific version for production helm install \ --namespace $NAMESPACE \ @@ -16,7 +16,7 @@ description: | --set image.tag=${IMAGE_TAG} \ --atomic \ --timeout "5m" \ - --debug \ # optional --values ./myvaluesfile/values.yaml \ + --debug \ # optional --values --values .cache/charts/dsv-injector/values.yaml \ dsv-syncer ./charts/dsv-syncer ``` keywords: @@ -26,7 +26,7 @@ keywords: - secrets - vault type: application -version: v1.2.2 +version: v1.2.3 appVersion: latest maintainers: - name: Sheldon Hull diff --git a/charts/dsv-syncer/README.md b/charts/dsv-syncer/README.md index b453e7c..1911a56 100644 --- a/charts/dsv-syncer/README.md +++ b/charts/dsv-syncer/README.md @@ -1,9 +1,25 @@ # dsv-syncer -![Version: 0.1.3](https://img.shields.io/badge/Version-0.1.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) +![Version: v1.2.3](https://img.shields.io/badge/Version-v1.2.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) A Helm chart for the Delinea DevOps Secrets Vault (DSV) Kubernetes Synchronizer Job. +```shell +NAMESPACE='dsv' +IMAGE_REPOSITORY='docker.io/delineaxpm/dsv-k8s' +IMAGE_TAG='v1.2.3' # use latest for test, but pin to a specific version for production + +helm install \ + --namespace $NAMESPACE \ + --create-namespace \ + --set image.repository=${IMAGE_REPOSITORY} \ + --set image.tag=${IMAGE_TAG} \ + --atomic \ + --timeout "5m" \ + --debug \ # optional --values --values .cache/charts/dsv-injector/values.yaml \ + dsv-syncer ./charts/dsv-syncer +``` + ## Maintainers | Name | Email | Url | @@ -13,26 +29,33 @@ A Helm chart for the Delinea DevOps Secrets Vault (DSV) Kubernetes Synchronizer ## Values -| Key | Type | Default | Description | -| -------------------------------- | ------ | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| cronJobSchedule | string | `"* * * * *"` | cronJobSchedule controls when the syncer runs; five asterisks means "every minute". See [cronjob](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#cron-schedule-syntax) @default - every minute, ie '\* \* \* \* \*' | -| dsvInjectorCredentialsSecretName | string | `"dsv-injector-credentials"` | dsvInjectorCredentialsSecretName is the name of thecredentialsJson secret from the dsv-injector | -| fullnameOverride | string | `""` | | -| image.entrypoint | string | `"/app/dsv-syncer"` | Entrypoint is the path to the binary. Since the container image could contain multiple binaries, this makes sure it's correctly mapped to the binary. | -| image.pullPolicy | string | `"Always"` | | -| image.repository | string | `"docker.io/delineaxpm/dsv-k8s"` | | -| image.tag | string | `""` | | -| imagePullSecrets | list | `[]` | | -| nameOverride | string | `""` | | -| podAnnotations | object | `{}` | default annotations to add @default - Adds `dsv-filter-name` to simplify log selector streaming | -| podSecurityContext | object | `{}` | | -| replicaCount | int | `1` | replicaCount @default - 1 | -| resources | object | No default values, user must specify to set resource limits. | We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'. | -| securityContext | object | `{}` | | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account @default - Adds `dsv-filter-name` to simplify log selector streaming | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created @default - true | -| serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template | +| Key | Type | Default | Description | +| -------------------------------------- | ------ | ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| configmap | object | {} empty. | configmap are configuration values for the app to load. All of these are defaulted in the template itself and only need be set if adjusting. Since the user for the container is nonroot, only edit if you know what you are doing. Boolean values should be passed quoted to avoid issues. | +| cronJobSchedule | string | `"* * * * *"` | cronJobSchedule controls when the syncer runs; five asterisks means "every minute". See [cronjob](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#cron-schedule-syntax) @default - every minute, ie '\* \* \* \* \*' | +| dsvInjectorCredentialsSecretName | string | `"dsv-injector-credentials"` | dsvInjectorCredentialsSecretName is the name of thecredentialsJson secret from the dsv-injector | +| fullnameOverride | string | `""` | | +| image.args[0] | string | `"-environment"` | | +| image.args[1] | string | `"foo"` | | +| image.entrypoint | string | `"/app/dsv-syncer"` | Entrypoint is the path to the binary. Since the container image could contain multiple binaries, this makes sure it's correctly mapped to the binary. | +| image.pullPolicy | string | IfNotPresent | pullPolicy is the image pull policy. If running locally built images, you'll want to set to Never to ensure local loaded images are used. Local testing use: `Never`. | +| image.repository | string | `"docker.io/delineaxpm/dsv-k8s"` | | +| image.tag | string | the current app version/chart version | Overrides the image tag whose default is the chart appVersion. Local Testing: Use `latest`. | +| imagePullSecrets | list | `[]` | | +| nameOverride | string | `""` | | +| podAnnotations | object | `{}` | default annotations to add @default - Adds `dsv-filter-name` to simplify log selector streaming | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | replicaCount @default - 1 | +| resources | object | No default values, user must specify to set resource limits. | We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'. | +| securityContext | object | `{"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532}` | securityContext is the security context for the controller. This uses chainguard static nonroot based image. Reference: https://edu.chainguard.dev/chainguard/chainguard-images/reference/static/overview/ | +| securityContext.readOnlyRootFilesystem | bool | true | readOnlyRootFilesystem is the read only root file system flag. | +| securityContext.runAsGroup | int | 65532 (from chainguard static image) | runAsGroup is the run as group. | +| securityContext.runAsNonRoot | bool | true | runAsNonRoot is the run as non root flag. | +| securityContext.runAsUser | int | 65532 (from chainguard static image) | runAsUser is the run as user. | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account @default - Adds `dsv-filter-name` to simplify log selector streaming | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created @default - true | +| serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template | --- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/charts/dsv-syncer/templates/NOTES.txt b/charts/dsv-syncer/templates/NOTES.txt index 4acf8ec..7cdb060 100644 --- a/charts/dsv-syncer/templates/NOTES.txt +++ b/charts/dsv-syncer/templates/NOTES.txt @@ -1,9 +1,9 @@ ✨ Deployed: {{ include "dsv.fullname" . }} -📂 Namepsace: {{ .Release.Namespace }} +📂 Namespace: {{ .Release.Namespace }} {{- if .Values.configmap }} ⚙ī¸ ConfigMap created: {{ include "dsv.fullname" . }}-configmap {{ else }} ➖ no configmap detected, defaults used for logging level and any other configmap values -{{ end }} \ No newline at end of file +{{ end }} diff --git a/charts/dsv-syncer/values.yaml b/charts/dsv-syncer/values.yaml index d39f954..9464203 100644 --- a/charts/dsv-syncer/values.yaml +++ b/charts/dsv-syncer/values.yaml @@ -18,7 +18,7 @@ image: # -- Overrides the image tag whose default is the chart appVersion. # Local Testing: Use `latest`. # @default -- the current app version/chart version - tag: v1.2.2 + tag: v1.2.3 # -- Entrypoint is the path to the binary. Since the container image could contain multiple binaries, this makes sure it's correctly mapped to the binary. entrypoint: /app/dsv-syncer args: ['-environment', 'foo'] diff --git a/cmd/injector/main.go b/cmd/injector/main.go index 02b7eca..d4a3a9e 100644 --- a/cmd/injector/main.go +++ b/cmd/injector/main.go @@ -2,7 +2,10 @@ package main import ( "crypto/tls" + "crypto/x509" "encoding/json" + "encoding/pem" + "errors" "fmt" "io" "net/http" @@ -64,11 +67,11 @@ func Run(args []string) error { //nolint:funlen,cyclop // ok for Run // Config is the configuration for the injector. // This is provided by environment variables. type Config struct { - CertFile string `env:"DSV_CERT" envDefault:"${HOME}/tls/cert.pem" envExpand:"true"` // Cert is the path to the public certificate file in PEM format. - KeyFile string `env:"DSV_KEY" envDefault:"${HOME}/tls/key.pem" envExpand:"true"` // Key is the path to the private key file in PEM format. + CertFile string `env:"DSV_CERT" envDefault:"${HOME}/tls/tls.crt" envExpand:"true"` // Cert is the path to the public certificate file in PEM format. //nolint:tagalign // Incorrectly stripping tag. + KeyFile string `env:"DSV_KEY" envDefault:"${HOME}/tls/tls.key" envExpand:"true"` // Key is the path to the private key file in PEM format. //nolint:tagalign // Incorrectly stripping tag. CredentialsJSONFile string `env:"DSV_CREDENTIALS_JSON" envDefault:"${HOME}/credentials/config.json" envExpand:"true"` // CredentialsJSONFile is the path to the JSON formatted credentials file that is mounted as a secret. - ServerAddress string `env:"DSV_SERVER_ADDRESS" envDefault:":18543"` // ServerAddress is the address to listen on, e.g., 'localhost:8080' or ':8443' - Debug bool `env:"DSV_DEBUG" envDefault:"false"` // Debug enables debug logging. + ServerAddress string `env:"DSV_SERVER_ADDRESS" envDefault:":18543"` // ServerAddress is the address to listen on, e.g., 'localhost:8080' or ':8443' + Debug bool `env:"DSV_DEBUG" envDefault:"false"` // Debug enables debug logging. } cfg := Config{} @@ -96,12 +99,37 @@ func Run(args []string) error { //nolint:funlen,cyclop // ok for Run if cert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile); err == nil { tlsConfig = &tls.Config{Certificates: []tls.Certificate{cert}} log.Info().Str("cert", cfg.CertFile).Str("key", cfg.KeyFile).Msg("LoadX509KeyPair") + + // Parse the certificate to get the expiration date + certData, err := os.ReadFile(cfg.CertFile) + if err != nil { + log.Error().Err(err).Msg("unable to read certificate file") + return fmt.Errorf("unable to read certificate file: %w", err) + } + block, _ := pem.Decode(certData) + if block == nil { + log.Error().Msg("failed to parse certificate PEM") + return errors.New("failed to parse certificate PEM") + } + parsedCert, err := x509.ParseCertificate(block.Bytes) + if err != nil { + log.Error().Err(err).Msg("failed to parse certificate") + return fmt.Errorf("failed to parse certificate: %w", err) + } + + // Calculate the number of days until the certificate expires + daysUntilExpiry := int(time.Until(parsedCert.NotAfter).Hours() / 24) //nolint:gomnd // ok for this calculation + + log.Info(). + Str("cert", cfg.CertFile). + Str("key", cfg.KeyFile). + Int("days_until_expiry", daysUntilExpiry). + Msg("LoadX509KeyPair") } else { log.Error().Err(err).Msgf("unable to load keypair for TLS: %s", err) return fmt.Errorf("unable to load keypair for TLS: %w", err) } log.Info().Msgf("success loading keypair for TLS: [public: '%s', private: '%s']", cfg.CertFile, cfg.KeyFile) - server := http.Server{ Addr: cfg.ServerAddress, TLSConfig: tlsConfig, // optional diff --git a/docs/assets/info-markup-default-creds.svg b/docs/assets/info-markup-default-creds.svg index 9cc5518..37b9363 100644 --- a/docs/assets/info-markup-default-creds.svg +++ b/docs/assets/info-markup-default-creds.svg @@ -1,74 +1 @@ - - -
- -
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The injector uses the default credentials when mutating a Kubernetes Secret without a credentialAnnotation. -
-
-
- - +
The injector uses the default credentials when mutating a Kubernetes Secret without a credentialAnnotation.
 \ No newline at end of file diff --git a/docs/assets/random-dont-need-to-install.svg b/docs/assets/random-dont-need-to-install.svg index 7fb3e33..3b6f602 100644 --- a/docs/assets/random-dont-need-to-install.svg +++ b/docs/assets/random-dont-need-to-install.svg @@ -1,75 +1 @@ - - -
- -
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Save Yourself Some Work
- The image is on Docker Hub. You don't have to build and run this locally to use the helm charts. -
-
-
- - +
Save Yourself Some Work
The image is on Docker Hub. You don't have to build and run this locally to use the helm charts.
 \ No newline at end of file diff --git a/docs/assets/warning-app1-required-for-tests.svg b/docs/assets/warning-app1-required-for-tests.svg index c70f6b5..7ba55a9 100644 --- a/docs/assets/warning-app1-required-for-tests.svg +++ b/docs/assets/warning-app1-required-for-tests.svg @@ -1,45 +1 @@ - - -
- -
-
- - - - - - - - - - - The tests are hardcoded to expect app1, so ensure this is configured for the local tests. -
-
-
- - +
The tests are hardcoded to expect app1, so ensure this is configured for the local tests.
 \ No newline at end of file diff --git a/go.mod b/go.mod index 9a23df7..12cc019 100644 --- a/go.mod +++ b/go.mod @@ -1,78 +1,78 @@ module github.com/DelineaXPM/dsv-k8s/v2 -go 1.21 - -toolchain go1.21.6 +go 1.22.0 require ( - github.com/DelineaXPM/dsv-sdk-go/v2 v2.1.0 - github.com/bitfield/script v0.22.0 + github.com/DelineaXPM/dsv-sdk-go/v2 v2.1.2 + github.com/bitfield/script v0.22.1 github.com/brianvoe/gofakeit/v6 v6.28.0 github.com/caarlos0/env/v6 v6.10.1 github.com/magefile/mage v1.15.0 - github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91 - github.com/pterm/pterm v0.12.74 - github.com/rs/zerolog v1.31.0 - github.com/sheldonhull/magetools v1.0.1 - k8s.io/api v0.29.0 - k8s.io/apimachinery v0.29.0 - k8s.io/client-go v0.29.0 + github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 + github.com/pterm/pterm v0.12.79 + github.com/rs/zerolog v1.33.0 + github.com/sheldonhull/magetools v1.0.2 + k8s.io/api v0.30.3 + k8s.io/apimachinery v0.30.3 + k8s.io/client-go v0.30.3 ) require ( atomicgo.dev/cursor v0.2.0 // indirect atomicgo.dev/keyboard v0.2.9 // indirect atomicgo.dev/schedule v0.1.0 // indirect - github.com/aws/aws-sdk-go v1.44.119 // indirect - github.com/containerd/console v1.0.3 // indirect + github.com/aws/aws-sdk-go v1.55.5 // indirect + github.com/containerd/console v1.0.4 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/dustin/go-humanize v1.0.1 // indirect - github.com/emicklei/go-restful/v3 v3.11.0 // indirect - github.com/go-logr/logr v1.3.0 // indirect - github.com/go-openapi/jsonpointer v0.19.6 // indirect - github.com/go-openapi/jsonreference v0.20.2 // indirect - github.com/go-openapi/swag v0.22.3 // indirect + github.com/emicklei/go-restful/v3 v3.12.1 // indirect + github.com/go-logr/logr v1.4.2 // indirect + github.com/go-openapi/jsonpointer v0.21.0 // indirect + github.com/go-openapi/jsonreference v0.21.0 // indirect + github.com/go-openapi/swag v0.23.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/protobuf v1.5.3 // indirect + github.com/golang/protobuf v1.5.4 // indirect github.com/google/gnostic-models v0.6.8 // indirect github.com/google/gofuzz v1.2.0 // indirect - github.com/google/uuid v1.3.0 // indirect + github.com/google/uuid v1.6.0 // indirect github.com/gookit/color v1.5.4 // indirect github.com/imdario/mergo v0.3.12 // indirect - github.com/itchyny/gojq v0.12.12 // indirect - github.com/itchyny/timefmt-go v0.1.5 // indirect + github.com/itchyny/gojq v0.12.16 // indirect + github.com/itchyny/timefmt-go v0.1.6 // indirect github.com/jmespath/go-jmespath v0.4.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/lithammer/fuzzysearch v1.1.8 // indirect github.com/mailru/easyjson v0.7.7 // indirect github.com/mattn/go-colorable v0.1.13 // indirect - github.com/mattn/go-isatty v0.0.19 // indirect - github.com/mattn/go-runewidth v0.0.15 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mattn/go-runewidth v0.0.16 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect - github.com/rivo/uniseg v0.4.4 // indirect + github.com/rivo/uniseg v0.4.7 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/ztrue/tracerr v0.4.0 // indirect - golang.org/x/mod v0.10.0 // indirect - golang.org/x/net v0.23.0 // indirect - golang.org/x/oauth2 v0.10.0 // indirect - golang.org/x/sys v0.18.0 // indirect - golang.org/x/term v0.18.0 // indirect - golang.org/x/text v0.14.0 // indirect - golang.org/x/time v0.3.0 // indirect - google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.33.0 // indirect + golang.org/x/mod v0.20.0 // indirect + golang.org/x/net v0.28.0 // indirect + golang.org/x/oauth2 v0.22.0 // indirect + golang.org/x/sys v0.24.0 // indirect + golang.org/x/term v0.23.0 // indirect + golang.org/x/text v0.17.0 // indirect + golang.org/x/time v0.6.0 // indirect + google.golang.org/appengine v1.6.8 // indirect + google.golang.org/protobuf v1.34.2 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/klog/v2 v2.110.1 // indirect - k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect - k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect - mvdan.cc/sh/v3 v3.6.0 // indirect + k8s.io/klog/v2 v2.130.1 // indirect + k8s.io/kube-openapi v0.0.0-20240808142205-8e686545bdb8 // indirect + k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect + mvdan.cc/sh/v3 v3.8.0 // indirect sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect - sigs.k8s.io/yaml v1.3.0 // indirect + sigs.k8s.io/yaml v1.4.0 // indirect ) + +replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.16 diff --git a/go.sum b/go.sum index 13b2b59..0426360 100644 --- a/go.sum +++ b/go.sum @@ -8,6 +8,8 @@ atomicgo.dev/schedule v0.1.0 h1:nTthAbhZS5YZmgYbb2+DH8uQIZcTlIrd4eYr3UQxEjs= atomicgo.dev/schedule v0.1.0/go.mod h1:xeUa3oAkiuHYh8bKiQBRojqAMq3PXXbJujjb0hw8pEU= github.com/DelineaXPM/dsv-sdk-go/v2 v2.1.0 h1:+XXJ43iH4js8LIBr4MUGq1J09ycivNkTNhtn4mFyhY8= github.com/DelineaXPM/dsv-sdk-go/v2 v2.1.0/go.mod h1:NTdQaRBIRZ/8gIzs010CS/u69aVSmqD1zbESW25y2cE= +github.com/DelineaXPM/dsv-sdk-go/v2 v2.1.2 h1:cmX2QC9s5kPqmghWLLZP8YRFO1ZD/C59BpNH2ujP99w= +github.com/DelineaXPM/dsv-sdk-go/v2 v2.1.2/go.mod h1:tNlpIXJlIwQlRbobXDPme4qv/Rc8+a1GbuUhE3m4JhQ= github.com/MarvinJWendt/testza v0.1.0/go.mod h1:7AxNvlfeHP7Z/hDQ5JtE3OKYT3XFUeLCDE2DQninSqs= github.com/MarvinJWendt/testza v0.2.1/go.mod h1:God7bhG8n6uQxwdScay+gjm9/LnO4D3kkcZX4hv9Rp8= github.com/MarvinJWendt/testza v0.2.8/go.mod h1:nwIcjmr0Zz+Rcwfh3/4UhBp7ePKVhuBExvZqnKYWlII= @@ -20,14 +22,20 @@ github.com/MarvinJWendt/testza v0.5.2/go.mod h1:xu53QFE5sCdjtMCKk8YMQ2MnymimEctc github.com/atomicgo/cursor v0.0.1/go.mod h1:cBON2QmmrysudxNBFthvMtN32r3jxVRIvzkUiF/RuIk= github.com/aws/aws-sdk-go v1.44.119 h1:TPkpDsanBMcZaF5wHwpKhjkapRV/b7d2qdC+a+IPbmY= github.com/aws/aws-sdk-go v1.44.119/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo= +github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU= +github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU= github.com/bitfield/script v0.22.0 h1:LA7QHuEsXMPD52YLtxWrlqCCy+9FOpzNYfsRHC5Gsrc= github.com/bitfield/script v0.22.0/go.mod h1:ms4w+9B8f2/W0mbsgWDVTtl7K94bYuZc3AunnJC4Ebs= +github.com/bitfield/script v0.22.1 h1:DphxoC5ssYciwd0ZS+N0Xae46geAD/0mVWh6a2NUxM4= +github.com/bitfield/script v0.22.1/go.mod h1:fv+6x4OzVsRs6qAlc7wiGq8fq1b5orhtQdtW0dwjUHI= github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4= github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs= github.com/caarlos0/env/v6 v6.10.1 h1:t1mPSxNpei6M5yAeu1qtRdPAK29Nbcf/n3G7x+b3/II= github.com/caarlos0/env/v6 v6.10.1/go.mod h1:hvp/ryKXKipEkcuYjs9mI4bBCg+UI0Yhgm5Zu0ddvwc= github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw= github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U= +github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro= +github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= @@ -38,18 +46,28 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g= github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU= +github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84= github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY= github.com/frankban/quicktest v1.14.4/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY= github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= +github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= +github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ= +github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY= github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ= +github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4= github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= +github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE= +github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ= github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= @@ -57,8 +75,11 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= +github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= @@ -71,19 +92,28 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k= github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4= github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gookit/color v1.4.2/go.mod h1:fqRyamkC1W8uxl+lxCQxOT09l/vYfZ+QeiX3rKQHCoQ= github.com/gookit/color v1.5.0/go.mod h1:43aQb+Zerm/BWh2GnrgOQm7ffz7tvQXEKV6BFMl7wAo= github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0= github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w= github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU= github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA= +github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= +github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/itchyny/gojq v0.12.12 h1:x+xGI9BXqKoJQZkr95ibpe3cdrTbY8D9lonrK433rcA= github.com/itchyny/gojq v0.12.12/go.mod h1:j+3sVkjxwd7A7Z5jrbKibgOLn0ZfLWkV+Awxr/pyzJE= +github.com/itchyny/gojq v0.12.16 h1:yLfgLxhIr/6sJNVmYfQjTIv0jGctu6/DgDoivmxTr7g= +github.com/itchyny/gojq v0.12.16/go.mod h1:6abHbdC2uB9ogMS38XsErnfqJ94UlngIJGlRAIj4jTM= github.com/itchyny/timefmt-go v0.1.5 h1:G0INE2la8S6ru/ZI5JecgyzbbJNs5lG1RcBqa7Jm6GE= github.com/itchyny/timefmt-go v0.1.5/go.mod h1:nEP7L+2YmAbT2kZ2HfSs1d8Xtw9LY8D2stDBckWakZ8= +github.com/itchyny/timefmt-go v0.1.6 h1:ia3s54iciXDdzWzwaVKXZPbiXzxxnv1SPGFfM/myJ5Q= +github.com/itchyny/timefmt-go v0.1.6/go.mod h1:RRDZYC5s9ErkjQvTvvU7keJjxUYzIISJGxm9/mAERQg= github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg= github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo= github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8= @@ -117,16 +147,22 @@ github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ= github.com/matryer/is v1.4.1/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU= github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91 h1:JnZSkFP1/GLwKCEuuWVhsacvbDQIVa5BRwAwd+9k2Vw= github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0= +github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 h1:hQWBtNqRYrI7CWIaUSXXtNKR90KzcUA5uiuxFVWw7sU= +github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA= github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U= github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= +github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -136,8 +172,10 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= +github.com/onsi/ginkgo/v2 v2.20.0 h1:PE84V2mHqoT1sglvHc8ZdQtPcwmvvt29WLEEO3xmdZw= github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg= github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= +github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= @@ -152,19 +190,27 @@ github.com/pterm/pterm v0.12.36/go.mod h1:NjiL09hFhT/vWjQHSj1athJpx6H8cjpHXNAK5b github.com/pterm/pterm v0.12.40/go.mod h1:ffwPLwlbXxP+rxT0GsgDTzS3y3rmpAO1NMjUkGTYf8s= github.com/pterm/pterm v0.12.74 h1:fPsds9KisCyJh4NyY6bv8QJt3FLHceb5DxI6W0An9cc= github.com/pterm/pterm v0.12.74/go.mod h1:+M33aZWQVpmLmLbvjykyGZ4gAfeebznRo8JMbabaxQU= +github.com/pterm/pterm v0.12.79 h1:lH3yrYMhdpeqX9y5Ep1u7DejyHy7NSQg9qrBjF9dFT4= +github.com/pterm/pterm v0.12.79/go.mod h1:1v/gzOF1N0FsjbgTHZ1wVycRkKiatFvJSJC4IGaQAAo= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= +github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= +github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg= github.com/rs/zerolog v1.31.0 h1:FcTR3NnLWW+NnTwwhFWiJSZr4ECLpqCm6QsEnyvbV4A= github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss= +github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8= +github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss= github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ= github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= github.com/sheldonhull/magetools v1.0.1 h1:EzTRk0JUNl2MijssyrA2Cx+J/7SyjcTgXQmsMccDpaI= github.com/sheldonhull/magetools v1.0.1/go.mod h1:K5W5pCBkaBlDqnheO2mSWZ8s9t8IOsKehxvj70g8kpg= +github.com/sheldonhull/magetools v1.0.2 h1:d6+jt0sugXvIMl4eWf2H7dAVAaSd5sD3nV0pWE9eEyg= +github.com/sheldonhull/magetools v1.0.2/go.mod h1:+SSxBtmxx4p07Zequ/wc+v88rGTnKwRtNssMkj1ZaAU= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -193,12 +239,15 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E= golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE= +golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0= +golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -210,8 +259,12 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs= golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= +golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE= +golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg= golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8= golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI= +golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA= +golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -230,12 +283,15 @@ golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg= +golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -244,16 +300,23 @@ golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8= golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= +golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU= +golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= +golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc= +golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U= +golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= @@ -262,16 +325,21 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss= golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM= +golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM= +google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= +google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg= +google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= @@ -290,22 +358,38 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= k8s.io/api v0.29.0 h1:NiCdQMY1QOp1H8lfRyeEf8eOwV6+0xA6XEE44ohDX2A= k8s.io/api v0.29.0/go.mod h1:sdVmXoz2Bo/cb77Pxi71IPTSErEW32xa4aXwKH7gfBA= +k8s.io/api v0.30.3 h1:ImHwK9DCsPA9uoU3rVh4QHAHHK5dTSv1nxJUapx8hoQ= +k8s.io/api v0.30.3/go.mod h1:GPc8jlzoe5JG3pb0KJCSLX5oAFIW3/qNJITlDj8BH04= k8s.io/apimachinery v0.29.0 h1:+ACVktwyicPz0oc6MTMLwa2Pw3ouLAfAon1wPLtG48o= k8s.io/apimachinery v0.29.0/go.mod h1:eVBxQ/cwiJxH58eK/jd/vAk4mrxmVlnpBH5J2GbMeis= +k8s.io/apimachinery v0.30.3 h1:q1laaWCmrszyQuSQCfNB8cFgCuDAoPszKY4ucAjDwHc= +k8s.io/apimachinery v0.30.3/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc= k8s.io/client-go v0.29.0 h1:KmlDtFcrdUzOYrBhXHgKw5ycWzc3ryPX5mQe0SkG3y8= k8s.io/client-go v0.29.0/go.mod h1:yLkXH4HKMAywcrD82KMSmfYg2DlE8mepPR4JGSo5n38= +k8s.io/client-go v0.30.3 h1:bHrJu3xQZNXIi8/MoxYtZBBWQQXwy16zqJwloXXfD3k= +k8s.io/client-go v0.30.3/go.mod h1:8d4pf8vYu665/kUbsxWAQ/JDBNWqfFeZnvFiVdmx89U= k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0= k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo= +k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= +k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780= k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA= +k8s.io/kube-openapi v0.0.0-20240808142205-8e686545bdb8 h1:1Wof1cGQgA5pqgo8MxKPtf+qN6Sh/0JzznmeGPm1HnE= +k8s.io/kube-openapi v0.0.0-20240808142205-8e686545bdb8/go.mod h1:Os6V6dZwLNii3vxFpxcNaTmH8LJJBkOTg1N0tOA0fvA= k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI= k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= mvdan.cc/editorconfig v0.2.0/go.mod h1:lvnnD3BNdBYkhq+B4uBuFFKatfp02eB6HixDvEz91C0= mvdan.cc/sh/v3 v3.6.0 h1:gtva4EXJ0dFNvl5bHjcUEvws+KRcDslT8VKheTYkbGU= mvdan.cc/sh/v3 v3.6.0/go.mod h1:U4mhtBLZ32iWhif5/lD+ygy1zrgaQhUu+XFy7C8+TTA= +mvdan.cc/sh/v3 v3.8.0 h1:ZxuJipLZwr/HLbASonmXtcvvC9HXY9d2lXZHnKGjFc8= +mvdan.cc/sh/v3 v3.8.0/go.mod h1:w04623xkgBVo7/IUK89E0g8hBykgEpN0vgOj3RJr6MY= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4= sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08= sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo= sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8= +sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E= +sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY= diff --git a/renovate.json b/renovate.json index cec61bd..edc6fdd 100644 --- a/renovate.json +++ b/renovate.json @@ -1,13 +1,9 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "DelineaXPM/renovate-config:security" - ], + "extends": ["DelineaXPM/renovate-config:security"], "packageRules": [ { - "matchManagers": [ - "gomod" - ], + "matchManagers": ["gomod"], "matchPackageNames": [ "helm.sh/helm/v3", "github.com/mittwald/go-helm-client" @@ -16,17 +12,10 @@ "enabled": false }, { - "matchManagers": [ - "gomod" - ], - "matchPackageNames": [ - "k8s.io/api" - ], + "matchManagers": ["gomod"], + "matchPackageNames": ["k8s.io/api"], "groupName": "risky-k8s-changes", - "matchUpdateTypes": [ - "major", - "minor" - ], + "matchUpdateTypes": ["major", "minor"], "enabled": false } ]