chore: Prepare v1.5.0-beta.0 release (#1082)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: ashnamehrotra <26015861+ashnamehrotra@users.noreply.github.com>
eraser-dev · Sep 5, 2024 · 5b8d5e4 · 5b8d5e4
1 parent c60f83d
commit 5b8d5e4
Show file tree

Hide file tree

Showing 35 changed files with 1,204 additions and 138 deletions.
diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-VERSION := v1.4.0-beta.0
+VERSION := v1.5.0-beta.0
 
 MANAGER_TAG ?= ${VERSION}
 TRIVY_SCANNER_TAG ?= ${VERSION}

diff --git a/charts/eraser/Chart.yaml b/charts/eraser/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: eraser
 description: A Helm chart for Eraser
 type: application
-version: 1.4.0-beta.0
-appVersion: v1.4.0-beta.0
+version: 1.5.0-beta.0
+appVersion: v1.5.0-beta.0
 home: https://github.com/eraser-dev/eraser
 sources:
   - https://github.com/eraser-dev/eraser.git
diff --git a/charts/eraser/README.md b/charts/eraser/README.md
@@ -45,15 +45,17 @@ _See [helm install](https://helm.sh/docs/helm/helm_install/) for command documen
 | runtimeConfig.manager.imageJob.cleanup          | Settings for image job cleanup.                                                                      | `{}`                           |
 | runtimeConfig.manager.pullSecrets               | Image pull secrets for collector/scanner/eraser.                                                     | `[]`                           |
 | runtimeConfig.manager.priorityClassName         | Priority class name for collector/scanner/eraser.                                                    | `""`                           |
+| runtimeConfig.manager.additionalPodLabels       | Additional labels for all pods that the controller creates at runtime.                               | `{}`                           |
 | runtimeConfig.manager.nodeFilter                | Filter for nodes.                                                                                    | `{}`                           |
-| runtimeConfig.components.collector              | Settings for the collector component.                                                                | `{ enabled: false }`           |
-| runtimeConfig.components.scanner                | Settings for the scanner component.                                                                  | `{ enabled: false }`           |
+| runtimeConfig.components.collector              | Settings for the collector component.                                                                | `{ enabled: true }`           |
+| runtimeConfig.components.scanner                | Settings for the scanner component.                                                                  | `{ enabled: true }`           |
 | runtimeConfig.components.eraser                 | Settings for the eraser component.                                                                   | `{}`                           |
 | deploy.image.repo                               | Repository for the image.                                                                            | `ghcr.io/eraser-dev/eraser-manager` |
 | deploy.image.pullPolicy                         | Policy for pulling the image.                                                                        | `IfNotPresent`                 |
 | deploy.image.tag                                | Overrides the default image tag.                                                                     | `""`                           |
 | deploy.additionalArgs                           | Additional arguments to pass to the command.                                                         | `[]`                           |
 | deploy.priorityClassName                        | Priority class name.                                                                                 | `""`                           |
+| deploy.additionalPodLabels                      | Additional labels for the controller pod.                                                            | `{}`                           |
 | deploy.securityContext.allowPrivilegeEscalation | Whether to allow privilege escalation.                                                               | `false`                        |
 | deploy.resources.limits.memory                  | Memory limit for the resources.                                                                      | `30Mi`                         |
 | deploy.resources.requests.cpu                   | CPU request for the resources.                                                                       | `100m`                         |

diff --git a/charts/eraser/templates/eraser-controller-manager-deployment.yaml b/charts/eraser/templates/eraser-controller-manager-deployment.yaml
@@ -21,6 +21,7 @@ spec:
   template:
     metadata:
       labels:
+        {{- if .Values.deploy.additionalPodLabels }}{{- toYaml .Values.deploy.additionalPodLabels | nindent 8 }}{{end}}
         app.kubernetes.io/instance: '{{ .Release.Name }}'
         app.kubernetes.io/managed-by: '{{ .Release.Service }}'
         app.kubernetes.io/name: '{{ template "eraser.name" . }}'

diff --git a/charts/eraser/templates/eraser-imagejob-pods-cluster-role-clusterrole.yaml b/charts/eraser/templates/eraser-imagejob-pods-cluster-role-clusterrole.yaml
diff --git a/charts/eraser/templates/eraser-manager-role-clusterrole.yaml b/charts/eraser/templates/eraser-manager-role-clusterrole.yaml
@@ -1,26 +1,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  creationTimestamp: null
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
     app.kubernetes.io/managed-by: '{{ .Release.Service }}'
     app.kubernetes.io/name: '{{ template "eraser.name" . }}'
     helm.sh/chart: '{{ template "eraser.name" . }}'
   name: eraser-manager-role
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -29,29 +16,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - podtemplates
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - eraser.sh
   resources:
@@ -61,8 +25,6 @@ rules:
   - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - eraser.sh
@@ -77,12 +39,8 @@ rules:
   resources:
   - imagelists
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - eraser.sh

diff --git a/charts/eraser/templates/eraser-manager-role-role.yaml b/charts/eraser/templates/eraser-manager-role-role.yaml
@@ -0,0 +1,46 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/instance: '{{ .Release.Name }}'
+    app.kubernetes.io/managed-by: '{{ .Release.Service }}'
+    app.kubernetes.io/name: '{{ template "eraser.name" . }}'
+    helm.sh/chart: '{{ template "eraser.name" . }}'
+  name: eraser-manager-role
+  namespace: '{{ .Release.Namespace }}'
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - podtemplates
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/...uster-rolebinding-clusterrolebinding.yaml → ...aser-manager-rolebinding-rolebinding.yaml b/...uster-rolebinding-clusterrolebinding.yaml → ...aser-manager-rolebinding-rolebinding.yaml
@@ -1,17 +1,18 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
     app.kubernetes.io/managed-by: '{{ .Release.Service }}'
     app.kubernetes.io/name: '{{ template "eraser.name" . }}'
     helm.sh/chart: '{{ template "eraser.name" . }}'
-  name: eraser-imagejob-pods-cluster-rolebinding
+  name: eraser-manager-rolebinding
+  namespace: '{{ .Release.Namespace }}'
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: eraser-imagejob-pods-cluster-role
+  kind: Role
+  name: eraser-manager-role
 subjects:
 - kind: ServiceAccount
-  name: eraser-imagejob-pods
+  name: eraser-controller-manager
   namespace: '{{ .Release.Namespace }}'
diff --git a/charts/eraser/templates/imagejobs.eraser.sh-customresourcedefinition.yaml b/charts/eraser/templates/imagejobs.eraser.sh-customresourcedefinition.yaml
@@ -2,8 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.14.0
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
     app.kubernetes.io/managed-by: '{{ .Release.Service }}'
@@ -25,10 +24,19 @@ spec:
         description: ImageJob is the Schema for the imagejobs API.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -74,10 +82,19 @@ spec:
         description: ImageJob is the Schema for the imagejobs API.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object

diff --git a/charts/eraser/templates/imagelists.eraser.sh-customresourcedefinition.yaml b/charts/eraser/templates/imagelists.eraser.sh-customresourcedefinition.yaml
@@ -2,8 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.14.0
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
     app.kubernetes.io/managed-by: '{{ .Release.Service }}'
@@ -25,10 +24,19 @@ spec:
         description: ImageList is the Schema for the imagelists API.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -81,10 +89,19 @@ spec:
         description: ImageList is the Schema for the imagelists API.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object

diff --git a/charts/eraser/values.yaml b/charts/eraser/values.yaml
@@ -29,6 +29,7 @@ runtimeConfig:
         # delayOnFailure: ""
     pullSecrets: [] # image pull secrets for collector/scanner/eraser
     priorityClassName: "" # priority class name for collector/scanner/eraser
+    additionalPodLabels: {}
     nodeFilter:
       type: exclude # must be either exclude|include
       selectors:
@@ -39,7 +40,7 @@ runtimeConfig:
       enabled: true
       image:
         # repo: ""
-        tag: "v1.4.0-beta.0"
+        tag: "v1.5.0-beta.0"
       request: {}
         # mem: ""
         # cpu: ""
@@ -50,7 +51,7 @@ runtimeConfig:
       enabled: true
       image:
         # repo: ""
-        tag: "v1.4.0-beta.0"
+        tag: "v1.5.0-beta.0"
       request: {}
         # mem: ""
         # cpu: ""
@@ -63,7 +64,7 @@ runtimeConfig:
         # deleteFailedImages: true
         # deleteEOLImages: true
         # vulnerabilities:
-        #   ignoreUnfixed: true
+        #   ignoreUnfixed: false
         #   types:
         #     - os
         #     - library
@@ -81,7 +82,7 @@ runtimeConfig:
     remover:
       image:
         # repo: ""
-        tag: "v1.4.0-beta.0"
+        tag: "v1.5.0-beta.0"
       request: {}
         # mem: ""
         # cpu: ""
@@ -94,9 +95,10 @@ deploy:
     repo: ghcr.io/eraser-dev/eraser-manager
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "v1.4.0-beta.0"
+    tag: "v1.5.0-beta.0"
   additionalArgs: []
   priorityClassName: ""
+  additionalPodLabels: {}
 
   securityContext:
     allowPrivilegeEscalation: false