Skip to content

Commit 677f725

Browse files
inteoninteon
authored
Merge pull request #642 from jetstack/bump-modules
Manual module + dependency bumps
2 parents 6d9adf4 + 3975838 commit 677f725

File tree

14 files changed

+203
-161
lines changed

14 files changed

+203
-161
lines changed

‎.github/workflows/govulncheck.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
run: |
2929
make print-go-version >> "$GITHUB_OUTPUT"
3030
31-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
31+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
3232
with:
3333
go-version: ${{ steps.go-version.outputs.result }}
3434

‎.github/workflows/make-self-upgrade.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
run: |
4343
make print-go-version >> "$GITHUB_OUTPUT"
4444
45-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
45+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
4646
with:
4747
go-version: ${{ steps.go-version.outputs.result }}
4848

‎go.mod

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,9 @@ require (
5959
go.opentelemetry.io/otel/trace v1.28.0 // indirect
6060
go.uber.org/multierr v1.11.0 // indirect
6161
go.uber.org/zap v1.27.0 // indirect
62-
golang.org/x/crypto v0.32.0 // indirect
62+
golang.org/x/crypto v0.35.0 // indirect
6363
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
64-
golang.org/x/net v0.34.0 // indirect
64+
golang.org/x/net v0.36.0 // indirect
6565
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
6666
google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 // indirect
6767
google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 // indirect
@@ -81,7 +81,7 @@ require (
8181
github.com/go-openapi/jsonreference v0.20.4 // indirect
8282
github.com/go-openapi/swag v0.23.0 // indirect
8383
github.com/gogo/protobuf v1.3.2 // indirect
84-
github.com/golang-jwt/jwt/v4 v4.5.1
84+
github.com/golang-jwt/jwt/v4 v4.5.2
8585
github.com/google/go-cmp v0.6.0 // indirect
8686
github.com/google/gofuzz v1.2.0 // indirect
8787
github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -97,9 +97,9 @@ require (
9797
github.com/prometheus/common v0.62.0 // indirect
9898
github.com/prometheus/procfs v0.15.1 // indirect
9999
golang.org/x/oauth2 v0.24.0 // indirect
100-
golang.org/x/sys v0.29.0 // indirect
101-
golang.org/x/term v0.28.0 // indirect
102-
golang.org/x/text v0.21.0 // indirect
100+
golang.org/x/sys v0.30.0 // indirect
101+
golang.org/x/term v0.29.0 // indirect
102+
golang.org/x/text v0.22.0 // indirect
103103
golang.org/x/time v0.7.0 // indirect
104104
google.golang.org/protobuf v1.36.1 // indirect
105105
gopkg.in/inf.v0 v0.9.1 // indirect

‎go.sum

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@ github.com/go418/concurrentcache/logger v0.0.0-20250207095056-c0b7f8cc8bc2 h1:wV
6969
github.com/go418/concurrentcache/logger v0.0.0-20250207095056-c0b7f8cc8bc2/go.mod h1:DpmmUFByr4p8fGMbp2gsGJhqgcP1SXjyVZDiW0f8aSY=
7070
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
7171
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
72-
github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo=
73-
github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
72+
github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
73+
github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
7474
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
7575
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
7676
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -228,8 +228,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
228228
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
229229
golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
230230
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
231-
golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
232-
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
231+
golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
232+
golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
233233
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
234234
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
235235
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -238,8 +238,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
238238
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
239239
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
240240
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
241-
golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
242-
golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
241+
golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA=
242+
golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I=
243243
golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
244244
golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
245245
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -252,14 +252,14 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
252252
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
253253
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
254254
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
255-
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
256-
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
257-
golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
258-
golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
255+
golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
256+
golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
257+
golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
258+
golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
259259
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
260260
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
261-
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
262-
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
261+
golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
262+
golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
263263
golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
264264
golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
265265
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎klone.yaml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,50 +10,50 @@ targets:
1010
- folder_name: generate-verify
1111
repo_url: https://github.com/cert-manager/makefile-modules.git
1212
repo_ref: main
13-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
13+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
1414
repo_path: modules/generate-verify
1515
- folder_name: go
1616
repo_url: https://github.com/cert-manager/makefile-modules.git
1717
repo_ref: main
18-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
18+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
1919
repo_path: modules/go
2020
- folder_name: helm
2121
repo_url: https://github.com/cert-manager/makefile-modules.git
2222
repo_ref: main
23-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
23+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
2424
repo_path: modules/helm
2525
- folder_name: help
2626
repo_url: https://github.com/cert-manager/makefile-modules.git
2727
repo_ref: main
28-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
28+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
2929
repo_path: modules/help
3030
- folder_name: kind
3131
repo_url: https://github.com/cert-manager/makefile-modules.git
3232
repo_ref: main
33-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
33+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
3434
repo_path: modules/kind
3535
- folder_name: klone
3636
repo_url: https://github.com/cert-manager/makefile-modules.git
3737
repo_ref: main
38-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
38+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
3939
repo_path: modules/klone
4040
- folder_name: oci-build
4141
repo_url: https://github.com/cert-manager/makefile-modules.git
4242
repo_ref: main
43-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
43+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
4444
repo_path: modules/oci-build
4545
- folder_name: oci-publish
4646
repo_url: https://github.com/cert-manager/makefile-modules.git
4747
repo_ref: main
48-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
48+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
4949
repo_path: modules/oci-publish
5050
- folder_name: repository-base
5151
repo_url: https://github.com/cert-manager/makefile-modules.git
5252
repo_ref: main
53-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
53+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
5454
repo_path: modules/repository-base
5555
- folder_name: tools
5656
repo_url: https://github.com/cert-manager/makefile-modules.git
5757
repo_ref: main
58-
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
58+
repo_hash: 7740a28745d013a286c0573a180d0aa53ff0aa6a
5959
repo_path: modules/tools

‎make/_shared/generate-verify/util/verify.sh

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,17 @@ cleanup() {
4444
}
4545
trap "cleanup" EXIT SIGINT
4646

47-
rsync -aEq "${projectdir}/." "${tmp}" --exclude "_bin/"
47+
# Why not just "cp" to the tmp dir?
48+
# A dumb "cp" will fail sometimes since _bin can get changed while it's being copied if targets are run in parallel,
49+
# and cp doesn't have some universal "exclude" option to ignore "_bin"
50+
#
51+
# We previously used "rsync" here, but:
52+
# 1. That's another tool we need to depend on
53+
# 2. rsync on macOS 15.4 and newer is actually openrsync, which has different permissions and throws errors when copying git objects
54+
#
55+
# So, we use find to list all files except _bin, and then copy each in turn
56+
find . -maxdepth 1 -not \( -path "./_bin" -prune \) | xargs -I% cp -af "${projectdir}/%" "${tmp}/"
57+
4858
pushd "${tmp}" >/dev/null
4959

5060
"$@"

‎make/_shared/go/base/.github/workflows/govulncheck.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
run: |
2929
make print-go-version >> "$GITHUB_OUTPUT"
3030
31-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
31+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
3232
with:
3333
go-version: ${{ steps.go-version.outputs.result }}
3434

‎make/_shared/helm/helm.mk

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,28 @@ $(bin_dir)/scratch/kyverno/pod-security-policy.yaml: | $(NEEDS_KUSTOMIZE) $(bin_
128128
# Extra arguments for kyverno apply.
129129
kyverno_apply_extra_args :=
130130
# Allows known policy violations to be skipped by supplying Kyverno policy
131-
# exceptions.
131+
# exceptions as a Kyverno YAML resource, e.g.:
132+
# apiVersion: kyverno.io/v2
133+
# kind: PolicyException
134+
# metadata:
135+
# name: pod-security-exceptions
136+
# spec:
137+
# exceptions:
138+
# - policyName: disallow-privilege-escalation
139+
# ruleNames:
140+
# - autogen-privilege-escalation
141+
# - policyName: restrict-seccomp-strict
142+
# ruleNames:
143+
# - autogen-check-seccomp-strict
144+
# match:
145+
# any:
146+
# - resources:
147+
# kinds:
148+
# - Deployment
149+
# namespaces:
150+
# - mynamespace
151+
# names:
152+
# - my-deployment
132153
ifneq ("$(wildcard make/verify-pod-security-standards-exceptions.yaml)","")
133154
kyverno_apply_extra_args += --exceptions make/verify-pod-security-standards-exceptions.yaml
134155
endif

‎make/_shared/kind/00_kind_image_versions.mk

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,16 @@
1515
# This file is auto-generated by the learn_kind_images.sh script in the makefile-modules repo.
1616
# Do not edit manually.
1717

18-
kind_image_kindversion := v0.26.0
18+
kind_image_kindversion := v0.27.0
1919

20-
kind_image_kube_1.29_amd64 := docker.io/kindest/node:v1.29.12@sha256:c1b696872c6d4d41889c1c7ca460d6c6349665061e6dd2a9cc5abda7dd8e21bc
21-
kind_image_kube_1.29_arm64 := docker.io/kindest/node:v1.29.12@sha256:a29e3189829c4784b31507c793b5d186914a6ed81d2296c39d32543988911f36
22-
kind_image_kube_1.30_amd64 := docker.io/kindest/node:v1.30.8@sha256:da9368e0cfa74ca1a7e2c6d6c7abf890e627a94d9c8300dd9d951f63947a456c
23-
kind_image_kube_1.30_arm64 := docker.io/kindest/node:v1.30.8@sha256:27b247e13bac7271e013ea4118843f8072e5a4f1fa8ce2c5c47018e6b2d45cce
24-
kind_image_kube_1.31_amd64 := docker.io/kindest/node:v1.31.4@sha256:29370cbe44fd9798ac1e47e7ad04e53c375c0c683a25cc0cc7db331ad07c9952
25-
kind_image_kube_1.31_arm64 := docker.io/kindest/node:v1.31.4@sha256:496ab674cddaa72e97f2aa70729df5b403f46ee5834fb9a44773284998fea6d5
26-
kind_image_kube_1.32_amd64 := docker.io/kindest/node:v1.32.0@sha256:dd45e7e76478f76d2881cf031e64512f51be63dcb61420307982a24913badf8f
27-
kind_image_kube_1.32_arm64 := docker.io/kindest/node:v1.32.0@sha256:eff24f9d99bc56271a456484d87cd6e6fc0beec7d4418958d589804703c00588
20+
kind_image_kube_1.29_amd64 := docker.io/kindest/node:v1.29.14@sha256:e7858e6394f5e834802ce573ab340a0584d8314f909cb0717e14b57f2dd97257
21+
kind_image_kube_1.29_arm64 := docker.io/kindest/node:v1.29.14@sha256:6eed9bfd0313cc3574c4613adeb7f53832cb8d9c0ca9ffa8b8221716fd96dc18
22+
kind_image_kube_1.30_amd64 := docker.io/kindest/node:v1.30.10@sha256:e382f9b891474f1c4b0b5cfcf27f8e471f1bdc1f285afe38adeec1bd5b856cfe
23+
kind_image_kube_1.30_arm64 := docker.io/kindest/node:v1.30.10@sha256:ca8e16c04ee9ebaeb9a4dd85abbe188f3893fb39bd658d6d3e639d16cf46e3da
24+
kind_image_kube_1.31_amd64 := docker.io/kindest/node:v1.31.6@sha256:37d52dc19f59394f9347b00547c3ed2d73eb301a60294b9b05fbe56fb6196517
25+
kind_image_kube_1.31_arm64 := docker.io/kindest/node:v1.31.6@sha256:4e6223faa19178922d30e7b62546c5464fdf9bc66a3df64073424a51ab44f2ab
26+
kind_image_kube_1.32_amd64 := docker.io/kindest/node:v1.32.2@sha256:a37b679ad8c1cfa7c64aca1734cc4299dc833258d6c131ed0204c8cd2bd56ff7
27+
kind_image_kube_1.32_arm64 := docker.io/kindest/node:v1.32.2@sha256:4d0e1b60f1da0d1349996a9778f8bace905189af5e05e04618eae0a155dd9f9c
2828

2929
kind_image_latest_amd64 := $(kind_image_kube_1.32_amd64)
3030
kind_image_latest_arm64 := $(kind_image_kube_1.32_arm64)

‎make/_shared/kind/kind-image-preload.mk

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -32,18 +32,33 @@ images_files := $(foreach image,$(images),$(subst :,+,$(image)))
3232
images_tar_dir := $(bin_dir)/downloaded/containers/$(HOST_ARCH)
3333
images_tars := $(images_files:%=$(images_tar_dir)/%.tar)
3434

35-
# Download the images as tarballs. We must use the tag because the digest
36-
# will change after we docker import the image. The tag is the only way to
37-
# reference the image after it has been imported. Before downloading the
38-
# image, we check that the provided digest matches the digest of the image
39-
# that we are about to pull.
40-
$(images_tars): $(images_tar_dir)/%.tar: | $(NEEDS_CRANE)
41-
@$(eval image=$(subst +,:,$*))
42-
@$(eval image_without_digest=$(shell cut -d@ -f1 <<<"$(image)"))
43-
@$(eval digest=$(subst $(image_without_digest)@,,$(image)))
44-
@mkdir -p $(dir $@)
45-
diff <(echo "$(digest) -" | cut -d: -f2) <($(CRANE) manifest --platform=linux/$(HOST_ARCH) $(image_without_digest) | sha256sum)
46-
$(CRANE) pull $(image_without_digest) $@ --platform=linux/$(HOST_ARCH)
35+
# Download the images as tarballs. After downloading the image using
36+
# its digest, we untar the image and modify the .[0].RepoTags[0] value in
37+
# the manifest.json file to have the correct tag (instead of "i-was-a-digest"
38+
# which is set when the image is pulled using its digest). This tag is used
39+
# to reference the image after it has been imported using docker or kind. Otherwise,
40+
# the image would be imported with the tag "i-was-a-digest" which is not very useful.
41+
# We would have to use digests to reference the image everywhere which might
42+
# not always be possible and does not match the default behavior of eg. our helm charts.
43+
# Untarring and modifying manifest.json is a hack and we hope that crane adds an option
44+
# in the future that allows setting the tag on images that are pulled by digest.
45+
# NOTE: the tag is fully determined based on the input, we fully allow the remote
46+
# tag to point to a different digest. This prevents CI from breaking due to upstream
47+
# changes. However, it also means that we can incorrectly combine digests with tags,
48+
# hence caution is advised.
49+
$(images_tars): $(images_tar_dir)/%.tar: | $(NEEDS_CRANE) $(NEEDS_GOJQ)
50+
@$(eval full_image=$(subst +,:,$*))
51+
@$(eval bare_image=$(word 1,$(subst :, ,$(full_image))))
52+
@$(eval digest=$(word 2,$(subst @, ,$(full_image))))
53+
@$(eval tag=$(word 2,$(subst :, ,$(word 1,$(subst @, ,$(full_image))))))
54+
@mkdir -p $@.tmp.unpacked
55+
$(CRANE) pull "$(bare_image)@$(digest)" $@.tmp --platform=linux/$(HOST_ARCH)
56+
@tar xf $@.tmp -C $@.tmp.unpacked
57+
@rm -rf $@.tmp
58+
@$(GOJQ) '.[0].RepoTags[0] |= rtrimstr("i-was-a-digest") + "$(tag)"' $@.tmp.unpacked/manifest.json > $@.tmp.unpacked/manifest.json.new
59+
@mv $@.tmp.unpacked/manifest.json.new $@.tmp.unpacked/manifest.json
60+
@find $@.tmp.unpacked \( -type f -o -type d \) -printf "%P\n" | tar -cf $@ --no-recursion -C $@.tmp.unpacked -T -
61+
@rm -rf $@.tmp.unpacked
4762

4863
images_tar_envs := $(images_files:%=env-%)
4964

‎make/_shared/oci-build/00_mod.mk

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ oci_platforms ?= linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
1616

1717
# Use distroless as minimal base image to package the manager binary
1818
# To get latest SHA run "crane digest quay.io/jetstack/base-static:latest"
19-
base_image_static := quay.io/jetstack/base-static@sha256:9202d031a2bf364519a07629e51daca08233e3096936563ea5f35f0e19003853
19+
base_image_static := quay.io/jetstack/base-static@sha256:713aaf3b2c45b103d37778943f2c384120eabb97b9097eea4b5cbbd32880b86d
2020

2121
# Use custom apko-built image as minimal base image to package the manager binary
2222
# To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest"
23-
base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:2e159b417e03b3d454c202f8281922784ef7153873dc5a62bdb5e456de9dc6db
23+
base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:3499c6d3073503bd13e015c27b039e58a790e5623906af1cf42ebbf85a8ff7f6
2424

2525
# Utility functions
2626
fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set))
@@ -43,8 +43,7 @@ go_$1_goexperiment ?= $(GOEXPERIMENT)
4343
go_$1_flags ?= -tags=
4444
oci_$1_additional_layers ?=
4545
oci_$1_linux_capabilities ?=
46-
oci_$1_image_annotation ?=
47-
oci_$1_image_label ?=
46+
oci_$1_build_args ?=
4847
endef
4948

5049
$(foreach build_name,$(build_names),$(eval $(call default_per_build_variables,$(build_name))))

‎make/_shared/oci-build/01_mod.mk

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,7 @@ $(oci_build_targets): oci-build-%: ko-config-% | $(NEEDS_KO) $(NEEDS_GO) $(NEEDS
6363
LDFLAGS="$(go_$*_ldflags)" \
6464
$(KO) build $(go_$*_mod_dir)/$(go_$*_main_dir) \
6565
--platform=$(oci_platforms) \
66-
--image-annotation=$(oci_$*_image_annotation) \
67-
--image-label=$(oci_$*_image_label) \
66+
$(oci_$*_build_args) \
6867
--oci-layout-path=$(oci_layout_path_$*) \
6968
--sbom-dir=$(CURDIR)/$(oci_layout_path_$*).sbom \
7069
--sbom=spdx \

‎make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
run: |
4343
make print-go-version >> "$GITHUB_OUTPUT"
4444
45-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
45+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
4646
with:
4747
go-version: ${{ steps.go-version.outputs.result }}
4848

0 commit comments

Comments
 (0)